@foss.global/codefeed 2.0.1 → 2.1.0

package/ts/classes.giteasourceinventory.ts

@@ -0,0 +1,882 @@
+import type * as plugins from './plugins.js';
+import * as transport from './forgeinventory.transport.js';
+import * as validation from './forgeinventory.validation.js';
+import { ForgeRequestClient } from './forgeinventory.client.js';
+import type { IForgeRequestMetrics, IForgeRequestOptions } from './forgeinventory.client.js';
+
+type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
+type TUnit = plugins.fossInterfaces.data.TForgeSourceInventoryUnit;
+type TUnitResult = plugins.fossInterfaces.data.TForgeSourceInventoryUnitResult;
+type IDiscovery = plugins.fossInterfaces.data.IForgeSourceInventoryDiscovery;
+type IInstance = plugins.fossInterfaces.data.IForgeSourceInstanceInventory;
+type TOwner = plugins.fossInterfaces.data.TForgeSourceOwnerInventory;
+type IRepository = plugins.fossInterfaces.data.IForgeSourceRepositoryInventory;
+type IPackageTypeCounts = plugins.fossInterfaces.data.IForgeSourcePackageTypeCounts;
+type IInventory = plugins.fossInterfaces.data.IForgeSourceInventory;
+
+export interface IGiteaSourceInventoryOptions {
+  /** Operator-assigned identity of the source instance. */
+  instanceId: string;
+  /** Instance root, including an optional deployment subpath. HTTPS is required. */
+  baseUrl: string;
+  /**
+   * A site administrator's token, retained only in this reader's memory. It is
+   * sent only to `baseUrl` and never appears in results, reasons or errors.
+   */
+  token: string;
+  /** PEM certificates that replace the default trust store for this reader's connections. */
+  caCertificates?: string[];
+  /** Items requested per page; Gitea caps it at its `MAX_RESPONSE_ITEMS`. */
+  pageSize?: number;
+  /** Pages read per listing before the listing counts as partial. */
+  maxPages?: number;
+  requestTimeoutMs?: number;
+  maxResponseBytes?: number;
+}
+
+export interface IGiteaSourceMeasureOptions {
+  signal?: AbortSignal;
+  /** Units measured at the same time. Requests within one unit are sequential. */
+  concurrency?: number;
+  /** Called once per unit as soon as its result exists, for example to persist it. */
+  onResult?: (resultArg: TUnitResult) => void | Promise<void>;
+}
+
+interface IListing {
+  items: unknown[];
+  /** A sanitized reason when the listing did not finish. */
+  failure: string | null;
+}
+
+interface IListOptions {
+  query?: Record<string, string>;
+  /** Reads as this user through the administrator's `Sudo` header. */
+  sudo?: string;
+  /** A 404 on the first page means an empty listing, for example a repository without a wiki. */
+  missingIsEmpty?: boolean;
+  /** Gitea answers `null` instead of an empty array on some listings, such as reactions. */
+  nullIsEmpty?: boolean;
+  /** Extracts the rows from an enveloped page. */
+  rows?: (bodyArg: unknown) => unknown;
+  signal?: AbortSignal;
+}
+
+/** The only limitation: data Gitea exposes to no administrator read and that the migration reissues. */
+export const giteaSourceInventoryLimitations: readonly string[] = [
+  'Gitea has no read that lists user-scoped Actions secrets; they are reissued.',
+];
+
+const lfsNotMeasured: TMeasure = { status: 'notMeasured', reason: 'Gitea exposes no API that lists LFS objects.' };
+
+const complete = (valueArg: bigint | number): TMeasure => ({ status: 'complete', value: BigInt(valueArg).toString() });
+const partial = (observedArg: bigint | number, reasonArg: string): TMeasure => ({ status: 'partial', observedValue: BigInt(observedArg).toString(), reason: reasonArg });
+const notMeasured = (reasonArg: string): TMeasure => ({ status: 'notMeasured', reason: reasonArg });
+const unitDisabled = (unitArg: string): TMeasure => notMeasured(`The ${unitArg} unit is disabled; Gitea's API hides its data.`);
+
+/** The value a measure observed so far. */
+const observed = (measureArg: TMeasure): bigint => measureArg.status === 'complete' ? BigInt(measureArg.value)
+  : measureArg.status === 'partial' ? BigInt(measureArg.observedValue) : 0n;
+
+/**
+ * Sums measures: complete only when every addend is, not measured when any
+ * addend is, otherwise partial with the observed sum and the first reason.
+ */
+const sumMeasures = (measuresArg: TMeasure[]): TMeasure => {
+  const missing = measuresArg.find((measureArg) => measureArg.status === 'notMeasured');
+  if (missing) return missing;
+  const total = measuresArg.reduce((sumArg, measureArg) => sumArg + observed(measureArg), 0n);
+  const unfinished = measuresArg.find((measureArg) => measureArg.status === 'partial');
+  return unfinished?.status === 'partial' ? partial(total, unfinished.reason) : complete(total);
+};
+
+const listingMeasure = (listingArg: IListing, valueArg: bigint = BigInt(listingArg.items.length)): TMeasure =>
+  listingArg.failure === null ? complete(valueArg) : partial(valueArg, listingArg.failure);
+
+/** A sanitized failure reason: adapter-owned error codes only, never remote text. */
+const reason = (errorArg: unknown): string => errorArg instanceof validation.ForgeInventoryError ? errorArg.code : 'unexpected-error';
+
+const requiredBoolean = (valueArg: unknown): boolean => {
+  if (typeof valueArg !== 'boolean') throw new validation.ForgeInventoryError('invalid-boolean');
+  return valueArg;
+};
+
+const requiredString = (valueArg: unknown): string => {
+  const value = validation.optionalString(valueArg);
+  if (value === null) throw new validation.ForgeInventoryError('invalid-string');
+  return value;
+};
+
+/** One provider path segment, as an owner or repository name. */
+const segment = (valueArg: unknown): string => {
+  const segments = validation.segments(valueArg);
+  if (segments.length !== 1) throw new validation.ForgeInventoryError('invalid-path');
+  return segments[0];
+};
+
+const ownerVisibility = (valueArg: unknown): plugins.fossInterfaces.data.TForgeInventoryVisibility => {
+  if (valueArg === 'limited') return 'internal';
+  const visibility = validation.visibility(valueArg);
+  if (visibility === null) throw new validation.ForgeInventoryError('invalid-visibility');
+  return visibility;
+};
+
+/** Files attached to an issue, pull request, comment or release, with their bytes. */
+const assets = (valueArg: unknown): { count: bigint; bytes: bigint } => {
+  if (valueArg === undefined || valueArg === null) return { count: 0n, bytes: 0n };
+  if (!Array.isArray(valueArg)) throw new validation.ForgeInventoryError('invalid-assets');
+  return valueArg.reduce((sumArg: { count: bigint; bytes: bigint }, assetArg: unknown) => ({
+    count: sumArg.count + 1n, bytes: sumArg.bytes + BigInt(validation.decimal(validation.record(assetArg).size)),
+  }), { count: 0n, bytes: 0n });
+};
+
+/** A `{ <rows>, total_count }` envelope whose rows must match its total. */
+const countedEnvelope = (bodyArg: unknown, rowsKeyArg: string): { rows: unknown[]; failure: string | null } => {
+  const body = validation.record(bodyArg);
+  const rows = body[rowsKeyArg] ?? [];
+  if (!Array.isArray(rows)) throw new validation.ForgeInventoryError('invalid-page');
+  return { rows, failure: validation.decimal(body.total_count) === String(rows.length) ? null : 'count-mismatch' };
+};
+
+const unitKey = (unitArg: TUnit): string => unitArg.kind === 'instance' ? 'instance'
+  : unitArg.kind === 'owner' ? `owner:${unitArg.ownerKind}:${unitArg.name}` : `repository:${unitArg.owner}/${unitArg.name}`;
+
+const compareText = (aArg: string, bArg: string): number => aArg < bArg ? -1 : aArg > bArg ? 1 : 0;
+
+/**
+ * Authenticated, read-only inventory of a Gitea instance through its REST API,
+ * read with a site administrator's token. It only sends GET requests, counts
+ * secrets and variables without retaining their values, and reports every
+ * read that did not finish as a partial or unmeasured value instead of a count.
+ */
+export class GiteaSourceInventory {
+  readonly #options: { instanceId: string; baseUrl: string; pageSize: number; maxPages: number };
+  readonly #client: ForgeRequestClient;
+
+  constructor(optionsArg: IGiteaSourceInventoryOptions) {
+    const baseUrl = validation.httpUrl(optionsArg.baseUrl);
+    if (!baseUrl || !baseUrl.startsWith('https:') || typeof optionsArg.instanceId !== 'string' || !optionsArg.instanceId.trim() ||
+      typeof optionsArg.token !== 'string' || !optionsArg.token || /[\s\u0000-\u001f\u007f]/.test(optionsArg.token)) {
+      throw new validation.ForgeInventoryError('invalid-options');
+    }
+    const limits = {
+      pageSize: optionsArg.pageSize ?? 50,
+      maxPages: optionsArg.maxPages ?? 10_000,
+      requestTimeoutMs: optionsArg.requestTimeoutMs ?? 60_000,
+      maxResponseBytes: optionsArg.maxResponseBytes ?? 16 * 1024 * 1024,
+    };
+    for (const [name, maximum] of [
+      ['pageSize', 100], ['maxPages', 1_000_000], ['requestTimeoutMs', 300_000], ['maxResponseBytes', 64 * 1024 * 1024],
+    ] as const) {
+      const value = limits[name];
+      if (!Number.isSafeInteger(value) || value < 1 || value > maximum) throw new validation.ForgeInventoryError('invalid-limits');
+    }
+    this.#options = { instanceId: optionsArg.instanceId, baseUrl: baseUrl.replace(/\/+$/, ''), pageSize: limits.pageSize, maxPages: limits.maxPages };
+    this.#client = new ForgeRequestClient({
+      transport: optionsArg.caCertificates === undefined ? transport.globalFetchTransport
+        : transport.createHttpsTransport(validation.caCertificates(optionsArg.caCertificates)),
+      headers: { authorization: `token ${optionsArg.token}` },
+      requestTimeoutMs: limits.requestTimeoutMs,
+      maxResponseBytes: limits.maxResponseBytes,
+    });
+  }
+
+  /** Validated, normalized instance root; contains no credentials or API suffix. */
+  public get baseUrl(): string { return this.#options.baseUrl; }
+
+  public get metrics(): IForgeRequestMetrics { return this.#client.metrics; }
+
+  /**
+   * Identifies the source and its reader and lists every owner and repository.
+   * Rejects unless the token belongs to a site administrator; a listing that
+   * does not finish is reported in `incompleteReasons`.
+   */
+  public async discover(signalArg?: AbortSignal): Promise<IDiscovery> {
+    const reader = validation.record((await this.#get('/user', { signal: signalArg })).body);
+    if (reader.is_admin !== true) throw new validation.ForgeInventoryError('reader-not-site-admin');
+    const version = validation.record((await this.#get('/version', { signal: signalArg })).body).version;
+    if (typeof version !== 'string' || version.length > 128 || !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9][A-Za-z0-9.+-]*)?$/.test(version)) {
+      throw new validation.ForgeInventoryError('invalid-server-version');
+    }
+    const incompleteReasons: string[] = [];
+    const organizations = await this.#list('/admin/orgs', { signal: signalArg });
+    const users = await this.#list('/admin/users', { signal: signalArg });
+    const repositories = await this.#list('/repos/search', {
+      signal: signalArg, query: { private: 'true', sort: 'id', order: 'asc' },
+      rows: (bodyArg) => {
+        const envelope = validation.record(bodyArg);
+        if (envelope.ok !== true) throw new validation.ForgeInventoryError('search-not-successful');
+        return envelope.data;
+      },
+    });
+    for (const [name, listing] of [['organizations', organizations], ['users', users], ['repositories', repositories]] as const) {
+      if (listing.failure !== null) incompleteReasons.push(`discovery: ${name}: ${listing.failure}`);
+    }
+    const owners = [
+      ...organizations.items.map((itemArg) => ({ kind: 'organization' as const, name: segment(validation.record(itemArg).name) })),
+      ...users.items.map((itemArg) => ({ kind: 'user' as const, name: segment(validation.record(itemArg).login) })),
+    ].sort((aArg, bArg) => compareText(aArg.kind, bArg.kind) || compareText(aArg.name, bArg.name));
+    const discovered = repositories.items.map((itemArg) => {
+      const item = validation.record(itemArg);
+      return { owner: segment(validation.record(item.owner).login), name: segment(item.name) };
+    }).sort((aArg, bArg) => compareText(aArg.owner, bArg.owner) || compareText(aArg.name, bArg.name));
+    return {
+      source: { instanceId: this.#options.instanceId, kind: 'gitea', baseUrl: this.#options.baseUrl, version },
+      reader: { login: segment(reader.login), siteAdmin: true },
+      owners,
+      repositories: discovered,
+      incompleteReasons: incompleteReasons.sort(compareText),
+    };
+  }
+
+  /** Every unit a run over this discovery measures: the instance, then owners, then repositories. */
+  public units(discoveryArg: IDiscovery): TUnit[] {
+    return [
+      { kind: 'instance' },
+      ...discoveryArg.owners.map((ownerArg): TUnit => ({ kind: 'owner', ownerKind: ownerArg.kind, name: ownerArg.name })),
+      ...discoveryArg.repositories.map((repositoryArg): TUnit => ({ kind: 'repository', owner: repositoryArg.owner, name: repositoryArg.name })),
+    ];
+  }
+
+  /** Measures one unit. Never rejects: a unit whose primary record cannot be read is `failed`. */
+  public async measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult> {
+    try {
+      if (unitArg.kind === 'instance') return { kind: 'instance', instance: await this.#instance(signalArg) };
+      if (unitArg.kind === 'owner') {
+        return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
+      }
+      return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, signalArg) };
+    } catch (error) {
+      return { kind: 'failed', unit: unitArg, reason: reason(error) };
+    }
+  }
+
+  /**
+   * Measures units with bounded concurrency; results keep the order of `unitsArg`.
+   * An aborted signal or a rejected `onResult` aborts the units in flight, hands
+   * over no further result and rejects once every worker has stopped.
+   */
+  public async measureUnits(unitsArg: TUnit[], optionsArg: IGiteaSourceMeasureOptions = {}): Promise<TUnitResult[]> {
+    const concurrency = optionsArg.concurrency ?? 4;
+    if (!Number.isSafeInteger(concurrency) || concurrency < 1 || concurrency > 16) throw new validation.ForgeInventoryError('invalid-concurrency');
+    const results: TUnitResult[] = new Array(unitsArg.length);
+    // The first failure aborts the units in flight; nothing is handed over after it.
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    if (optionsArg.signal?.aborted) abort();
+    optionsArg.signal?.addEventListener('abort', abort, { once: true });
+    let failure: { error: unknown } | null = null;
+    let next = 0;
+    const worker = async () => {
+      while (failure === null && next < unitsArg.length) {
+        const index = next++;
+        try {
+          if (controller.signal.aborted) throw new validation.ForgeInventoryError('request-aborted');
+          const result = await this.measureUnit(unitsArg[index], controller.signal);
+          if (failure !== null) return;
+          if (controller.signal.aborted) throw new validation.ForgeInventoryError('request-aborted');
+          results[index] = result;
+          await optionsArg.onResult?.(result);
+        } catch (error) {
+          failure ??= { error };
+          abort();
+        }
+      }
+    };
+    try {
+      await Promise.all(Array.from({ length: Math.min(concurrency, unitsArg.length) }, worker));
+    } finally {
+      optionsArg.signal?.removeEventListener('abort', abort);
+    }
+    if (failure !== null) throw (failure as { error: unknown }).error;
+    return results;
+  }
+
+  async #instance(signalArg?: AbortSignal): Promise<IInstance> {
+    const users = await this.#list('/admin/users', { signal: signalArg });
+    const flagged = (predicateArg: (userArg: Record<string, unknown>) => boolean): TMeasure => listingMeasure(
+      users, BigInt(users.items.filter((itemArg) => predicateArg(validation.record(itemArg))).length));
+    const runners = await this.#runners('/admin/actions/runners', { signal: signalArg });
+    return {
+      users: {
+        total: listingMeasure(users),
+        active: flagged((userArg) => requiredBoolean(userArg.active)),
+        admins: flagged((userArg) => requiredBoolean(userArg.is_admin)),
+        restricted: flagged((userArg) => requiredBoolean(userArg.restricted)),
+        prohibitLogin: flagged((userArg) => requiredBoolean(userArg.prohibit_login)),
+        externalAuth: flagged((userArg) => validation.decimal(userArg.source_id) !== '0'),
+        twoFactor: await this.#count('/admin/users', { signal: signalArg, query: { is_2fa_enabled: 'true' } }),
+      },
+      organizations: await this.#count('/admin/orgs', { signal: signalArg }),
+      systemWebhooks: await this.#count('/admin/hooks', { signal: signalArg, query: { type: 'all' } }),
+      runners,
+      unadoptedRepositories: await this.#count('/admin/unadopted', { signal: signalArg }),
+    };
+  }
+
+  async #ownerBase(nameArg: string, recordArg: Record<string, unknown>, repositoriesPathArg: string, signalArg?: AbortSignal) {
+    return {
+      name: nameArg,
+      id: validation.decimal(recordArg.id),
+      visibility: ownerVisibility(recordArg.visibility),
+      repositories: await this.#count(repositoriesPathArg, { signal: signalArg }),
+      packages: await this.#packages(nameArg, signalArg),
+    };
+  }
+
+  async #organization(nameArg: string, signalArg?: AbortSignal): Promise<TOwner> {
+    const path = `/orgs/${encodeURIComponent(nameArg)}`;
+    const organization = validation.record((await this.#get(path, { signal: signalArg })).body);
+    if (segment(organization.name) !== nameArg) throw new validation.ForgeInventoryError('owner-identity-changed');
+    const teams = await this.#list(`${path}/teams`, { signal: signalArg });
+    const memberships: TMeasure[] = [];
+    const grants: TMeasure[] = [];
+    for (const team of teams.items) {
+      const teamPath = `/teams/${validation.decimal(validation.record(team).id)}`;
+      memberships.push(await this.#count(`${teamPath}/members`, { signal: signalArg }));
+      grants.push(await this.#count(`${teamPath}/repos`, { signal: signalArg }));
+    }
+    const teamsMeasure = listingMeasure(teams);
+    const fromTeams = (measuresArg: TMeasure[]) => sumMeasures([...measuresArg, ...(teamsMeasure.status === 'complete' ? [] : [partial(0, teams.failure!)])]);
+    return {
+      kind: 'organization',
+      ...await this.#ownerBase(nameArg, organization, `${path}/repos`, signalArg),
+      webhooks: await this.#count(`${path}/hooks`, { signal: signalArg }),
+      actionsVariables: await this.#count(`${path}/actions/variables`, { signal: signalArg }),
+      runners: await this.#runners(`${path}/actions/runners`, { signal: signalArg }),
+      members: await this.#count(`${path}/members`, { signal: signalArg }),
+      teams: teamsMeasure,
+      teamMemberships: fromTeams(memberships),
+      teamRepositoryGrants: fromTeams(grants),
+      labels: await this.#count(`${path}/labels`, { signal: signalArg }),
+      actionsSecrets: await this.#count(`${path}/actions/secrets`, { signal: signalArg }),
+    };
+  }
+
+  async #user(nameArg: string, signalArg?: AbortSignal): Promise<TOwner> {
+    const path = `/users/${encodeURIComponent(nameArg)}`;
+    const user = validation.record((await this.#get(path, { signal: signalArg })).body);
+    if (segment(user.login) !== nameArg) throw new validation.ForgeInventoryError('owner-identity-changed');
+    // User-scoped settings are only readable as that user, through the administrator's Sudo header.
+    const sudo = { signal: signalArg, sudo: nameArg };
+    return {
+      kind: 'user',
+      ...await this.#ownerBase(nameArg, user, `${path}/repos`, signalArg),
+      account: {
+        admin: requiredBoolean(user.is_admin),
+        active: requiredBoolean(user.active),
+        restricted: requiredBoolean(user.restricted),
+        prohibitLogin: requiredBoolean(user.prohibit_login),
+        externalAuth: validation.decimal(user.source_id) !== '0',
+      },
+      webhooks: await this.#count('/user/hooks', sudo),
+      actionsVariables: await this.#count('/user/actions/variables', sudo),
+      runners: await this.#runners('/user/actions/runners', sudo),
+      sshKeys: await this.#count(`${path}/keys`, { signal: signalArg }),
+      gpgKeys: await this.#count(`${path}/gpg_keys`, { signal: signalArg }),
+    };
+  }
+
+  /** Package versions by type, with their files and bytes. */
+  async #packages(ownerArg: string, signalArg?: AbortSignal): Promise<IPackageTypeCounts[]> {
+    const ownerPath = `/packages/${encodeURIComponent(ownerArg)}`;
+    // Gitea lists one row per package version.
+    const versions = await this.#list(ownerPath, { signal: signalArg });
+    const byType = new Map<string, { names: Set<string>; versions: number; files: TMeasure[]; bytes: TMeasure[] }>();
+    for (const itemArg of versions.items) {
+      const item = validation.record(itemArg);
+      const type = requiredString(item.type);
+      // The type is reported and names reason paths, so it must be one of Gitea's plain identifiers.
+      if (!/^[a-z][a-z0-9_-]{0,31}$/.test(type)) throw new validation.ForgeInventoryError('invalid-package-type');
+      const name = requiredString(item.name);
+      const version = requiredString(item.version);
+      const entry = byType.get(type) ?? { names: new Set<string>(), versions: 0, files: [], bytes: [] };
+      byType.set(type, entry);
+      entry.names.add(name);
+      entry.versions++;
+      try {
+        const files = (await this.#get(`${ownerPath}/${[type, name, version].map(encodeURIComponent).join('/')}/files`, { signal: signalArg })).body;
+        if (!Array.isArray(files)) throw new validation.ForgeInventoryError('invalid-page');
+        const bytes = files.reduce((sumArg: bigint, fileArg: unknown) => sumArg + BigInt(validation.decimal(validation.record(fileArg).size)), 0n);
+        entry.files.push(complete(files.length));
+        entry.bytes.push(complete(bytes));
+      } catch (error) {
+        entry.files.push(partial(0, reason(error)));
+        entry.bytes.push(partial(0, reason(error)));
+      }
+    }
+    const unfinished = versions.failure === null ? [] : [partial(0, versions.failure)];
+    const counts = [...byType.entries()].sort(([aArg], [bArg]) => compareText(aArg, bArg)).map(([type, entry]): IPackageTypeCounts => ({
+      type,
+      packages: sumMeasures([complete(entry.names.size), ...unfinished]),
+      versions: sumMeasures([complete(entry.versions), ...unfinished]),
+      files: sumMeasures([...entry.files, ...unfinished]),
+      bytes: sumMeasures([...entry.bytes, ...unfinished]),
+    }));
+    // A listing that failed before its first row still has to surface as partial.
+    if (counts.length === 0 && versions.failure !== null) {
+      const failed = partial(0, versions.failure);
+      counts.push({ type: 'unknown', packages: failed, versions: failed, files: failed, bytes: failed });
+    }
+    return counts;
+  }
+
+  async #repository(ownerArg: string, nameArg: string, signalArg?: AbortSignal): Promise<IRepository> {
+    const path = `/repos/${encodeURIComponent(ownerArg)}/${encodeURIComponent(nameArg)}`;
+    const item = validation.record((await this.#get(path, { signal: signalArg })).body);
+    const owner = validation.record(item.owner);
+    if (segment(owner.login) !== ownerArg || segment(item.name) !== nameArg) throw new validation.ForgeInventoryError('repository-identity-changed');
+    const visibility = validation.giteaRepositoryVisibility(item.private, item.internal, owner.visibility);
+    if (visibility === null) throw new validation.ForgeInventoryError('invalid-visibility');
+    const empty = requiredBoolean(item.empty);
+    const features = {
+      issues: requiredBoolean(item.has_issues),
+      pullRequests: requiredBoolean(item.has_pull_requests),
+      wiki: requiredBoolean(item.has_wiki),
+      releases: requiredBoolean(item.has_releases),
+      packages: requiredBoolean(item.has_packages),
+      actions: requiredBoolean(item.has_actions),
+      projects: requiredBoolean(item.has_projects),
+    };
+    const fork = requiredBoolean(item.fork);
+    const parent = item.parent === undefined || item.parent === null ? null : requiredString(validation.record(item.parent).full_name);
+    if (fork !== (parent !== null)) throw new validation.ForgeInventoryError('inconsistent-fork-parent');
+    const options = { signal: signalArg };
+    return {
+      owner: ownerArg,
+      name: nameArg,
+      id: validation.decimal(item.id),
+      visibility,
+      fork,
+      parent,
+      mirror: requiredBoolean(item.mirror),
+      template: requiredBoolean(item.template),
+      archived: requiredBoolean(item.archived),
+      empty,
+      objectFormat: requiredString(item.object_format_name),
+      defaultBranch: requiredString(item.default_branch),
+      features,
+      git: await this.#git(path, item, empty, signalArg),
+      lfs: { objects: lfsNotMeasured, bytes: lfsNotMeasured },
+      collaboration: await this.#collaboration(path, features, signalArg),
+      // Releases stay readable while their unit is disabled; a disabled wiki answers 404.
+      releases: await this.#releases(path, signalArg),
+      wikiPages: features.wiki ? await this.#count(`${path}/wiki/pages`, { ...options, missingIsEmpty: true }) : unitDisabled('wiki'),
+      access: {
+        collaborators: await this.#count(`${path}/collaborators`, options),
+        teams: await this.#repositoryTeams(path, options),
+        deployKeys: await this.#count(`${path}/keys`, options),
+        webhooks: await this.#count(`${path}/hooks`, options),
+        branchProtections: await this.#unpagedCount(`${path}/branch_protections`, options),
+        tagProtections: await this.#unpagedCount(`${path}/tag_protections`, options),
+        pushMirrors: await this.#count(`${path}/push_mirrors`, options),
+      },
+      actions: await this.#actions(path, empty, signalArg),
+    };
+  }
+
+  /** Gitea answers 405 for a repository that no organization owns, which therefore has no teams. */
+  async #repositoryTeams(pathArg: string, optionsArg: IListOptions): Promise<TMeasure> {
+    try {
+      const body = (await this.#get(`${pathArg}/teams`, optionsArg)).body;
+      if (!Array.isArray(body)) throw new validation.ForgeInventoryError('invalid-page');
+      return complete(body.length);
+    } catch (error) {
+      if (error instanceof validation.ForgeInventoryError && error.code === 'http-405') return complete(0);
+      return partial(0, reason(error));
+    }
+  }
+
+  async #git(pathArg: string, itemArg: Record<string, unknown>, emptyArg: boolean, signalArg?: AbortSignal): Promise<IRepository['git']> {
+    const reportedSizeKiB = complete(BigInt(validation.decimal(itemArg.size)));
+    if (emptyArg) return { reportedSizeKiB, branches: complete(0), tags: complete(0), pullRequestRefs: complete(0), otherRefs: complete(0) };
+    try {
+      const refs = (await this.#get(`${pathArg}/git/refs`, { signal: signalArg })).body;
+      if (!Array.isArray(refs)) throw new validation.ForgeInventoryError('invalid-page');
+      const counts = { branches: 0, tags: 0, pullRequestRefs: 0, otherRefs: 0 };
+      for (const refArg of refs) {
+        const ref = requiredString(validation.record(refArg).ref);
+        if (ref.startsWith('refs/heads/')) counts.branches++;
+        else if (ref.startsWith('refs/tags/')) counts.tags++;
+        else if (ref.startsWith('refs/pull/')) counts.pullRequestRefs++;
+        else counts.otherRefs++;
+      }
+      return {
+        reportedSizeKiB, branches: complete(counts.branches), tags: complete(counts.tags),
+        pullRequestRefs: complete(counts.pullRequestRefs), otherRefs: complete(counts.otherRefs),
+      };
+    } catch (error) {
+      const failed = partial(0, reason(error));
+      return { reportedSizeKiB, branches: failed, tags: failed, pullRequestRefs: failed, otherRefs: failed };
+    }
+  }
+
+  async #collaboration(pathArg: string, featuresArg: IRepository['features'], signalArg?: AbortSignal): Promise<IRepository['collaboration']> {
+    const options = { signal: signalArg };
+    // Labels and milestones stay readable while the issue units are disabled.
+    const labels = await this.#count(`${pathArg}/labels`, options);
+    const milestones = await this.#count(`${pathArg}/milestones`, { ...options, query: { state: 'all' } });
+    if (!featuresArg.issues || !featuresArg.pullRequests) {
+      // A disabled unit silently drops its items from the shared issue listing; with both disabled the listings answer 404.
+      const hidden = unitDisabled(featuresArg.issues ? 'pull requests' : 'issues');
+      return {
+        issues: hidden, pullRequests: hidden, comments: hidden, reviews: hidden, reviewComments: hidden,
+        labels, milestones, reactions: hidden, attachments: hidden, attachmentBytes: hidden,
+      };
+    }
+    // Issues and pull requests share one listing and one number sequence.
+    const issues = await this.#list(`${pathArg}/issues`, { ...options, query: { state: 'all' } });
+    const unfinished = issues.failure === null ? [] : [partial(0, issues.failure)];
+    let issueCount = 0n;
+    let pullCount = 0n;
+    let attachments = { count: 0n, bytes: 0n };
+    const reactions: TMeasure[] = [...unfinished];
+    const reviews: TMeasure[] = [...unfinished];
+    const reviewComments: TMeasure[] = [...unfinished];
+    for (const itemArg of issues.items) {
+      const item = validation.record(itemArg);
+      const number = validation.decimal(item.number);
+      const isPull = item.pull_request !== undefined && item.pull_request !== null;
+      if (isPull) pullCount++; else issueCount++;
+      const itemAssets = assets(item.assets);
+      attachments = { count: attachments.count + itemAssets.count, bytes: attachments.bytes + itemAssets.bytes };
+      reactions.push(await this.#count(`${pathArg}/issues/${number}/reactions`, { ...options, nullIsEmpty: true }));
+      if (isPull) {
+        const pullReviews = await this.#list(`${pathArg}/pulls/${number}/reviews`, options);
+        reviews.push(listingMeasure(pullReviews));
+        const inline = pullReviews.items.reduce((sumArg: bigint, reviewArg: unknown) => sumArg + BigInt(validation.decimal(validation.record(reviewArg).comments_count)), 0n);
+        reviewComments.push(listingMeasure(pullReviews, inline));
+      }
+    }
+    const comments = await this.#list(`${pathArg}/issues/comments`, options);
+    const commentUnfinished = comments.failure === null ? [] : [partial(0, comments.failure)];
+    for (const commentArg of comments.items) {
+      const comment = validation.record(commentArg);
+      const commentAssets = assets(comment.assets);
+      attachments = { count: attachments.count + commentAssets.count, bytes: attachments.bytes + commentAssets.bytes };
+      reactions.push(await this.#unpagedCount(`${pathArg}/issues/comments/${validation.decimal(comment.id)}/reactions`, { ...options, nullIsEmpty: true }));
+    }
+    const attachmentUnfinished = [...unfinished, ...commentUnfinished];
+    return {
+      issues: listingMeasure(issues, issueCount),
+      pullRequests: listingMeasure(issues, pullCount),
+      comments: listingMeasure(comments),
+      reviews: sumMeasures(reviews),
+      reviewComments: sumMeasures(reviewComments),
+      labels,
+      milestones,
+      reactions: sumMeasures([...reactions, ...commentUnfinished]),
+      attachments: sumMeasures([complete(attachments.count), ...attachmentUnfinished]),
+      attachmentBytes: sumMeasures([complete(attachments.bytes), ...attachmentUnfinished]),
+    };
+  }
+
+  async #releases(pathArg: string, signalArg?: AbortSignal): Promise<IRepository['releases']> {
+    // An administrator's listing includes drafts.
+    const releases = await this.#list(`${pathArg}/releases`, { signal: signalArg });
+    let drafts = 0n;
+    let releaseAssets = { count: 0n, bytes: 0n };
+    for (const itemArg of releases.items) {
+      const item = validation.record(itemArg);
+      if (requiredBoolean(item.draft)) drafts++;
+      const itemAssets = assets(item.assets);
+      releaseAssets = { count: releaseAssets.count + itemAssets.count, bytes: releaseAssets.bytes + itemAssets.bytes };
+    }
+    return {
+      releases: listingMeasure(releases),
+      drafts: listingMeasure(releases, drafts),
+      assets: listingMeasure(releases, releaseAssets.count),
+      assetBytes: listingMeasure(releases, releaseAssets.bytes),
+    };
+  }
+
+  /** Every Actions read stays available while the repository's Actions unit is disabled. */
+  async #actions(pathArg: string, emptyArg: boolean, signalArg?: AbortSignal): Promise<IRepository['actions']> {
+    const options = { signal: signalArg };
+    const settings = {
+      secrets: await this.#count(`${pathArg}/actions/secrets`, options),
+      variables: await this.#count(`${pathArg}/actions/variables`, options),
+      runners: await this.#runners(`${pathArg}/actions/runners`, options),
+    };
+    let workflows: TMeasure;
+    if (emptyArg) {
+      workflows = complete(0);
+    } else {
+      try {
+        const listing = countedEnvelope((await this.#get(`${pathArg}/actions/workflows`, options)).body, 'workflows');
+        workflows = listing.failure === null ? complete(listing.rows.length) : partial(listing.rows.length, listing.failure);
+      } catch (error) {
+        workflows = partial(0, reason(error));
+      }
+    }
+    let runs: TMeasure;
+    try {
+      // The run history is archived, not migrated; its total sizes the archive without reading every run.
+      const body = validation.record((await this.#get(`${pathArg}/actions/runs`, { ...options, query: { limit: '1', page: '1' } })).body);
+      runs = complete(BigInt(validation.decimal(body.total_count)));
+    } catch (error) {
+      runs = partial(0, reason(error));
+    }
+    let artifacts: TMeasure;
+    let artifactBytes: TMeasure;
+    try {
+      const listing = countedEnvelope((await this.#get(`${pathArg}/actions/artifacts`, options)).body, 'artifacts');
+      const bytes = listing.rows.reduce((sumArg: bigint, artifactArg: unknown) => sumArg + BigInt(validation.decimal(validation.record(artifactArg).size_in_bytes)), 0n);
+      artifacts = listing.failure === null ? complete(listing.rows.length) : partial(listing.rows.length, listing.failure);
+      artifactBytes = listing.failure === null ? complete(bytes) : partial(bytes, listing.failure);
+    } catch (error) {
+      artifacts = artifactBytes = partial(0, reason(error));
+    }
+    return { workflows, ...settings, runs, artifacts, artifactBytes };
+  }
+
+  /** Runner listings are unpaged `{ runners, total_count }` envelopes. */
+  async #runners(pathArg: string, optionsArg: IListOptions): Promise<TMeasure> {
+    try {
+      const listing = countedEnvelope((await this.#get(pathArg, optionsArg)).body, 'runners');
+      return listing.failure === null ? complete(listing.rows.length) : partial(listing.rows.length, listing.failure);
+    } catch (error) {
+      return partial(0, reason(error));
+    }
+  }
+
+  async #unpagedCount(pathArg: string, optionsArg: IListOptions): Promise<TMeasure> {
+    try {
+      const response = (await this.#get(pathArg, optionsArg)).body;
+      const body = response === null && optionsArg.nullIsEmpty ? [] : response;
+      if (!Array.isArray(body)) throw new validation.ForgeInventoryError('invalid-page');
+      return complete(body.length);
+    } catch (error) {
+      return partial(0, reason(error));
+    }
+  }
+
+  async #count(pathArg: string, optionsArg: IListOptions): Promise<TMeasure> {
+    return listingMeasure(await this.#list(pathArg, optionsArg));
+  }
+
+  /**
+   * Reads every page of a listing. It ends at an empty page or once the rows
+   * reach `X-Total-Count`, and is partial when the total disagrees with the
+   * rows read, a page repeats, the page limit is reached or a page fails.
+   */
+  async #list(pathArg: string, optionsArg: IListOptions): Promise<IListing> {
+    const items: unknown[] = [];
+    let previousPage: string | null = null;
+    let total: bigint | null = null;
+    for (let page = 1; ; page++) {
+      if (page > this.#options.maxPages) return { items, failure: 'page-limit' };
+      let rows: unknown;
+      let totalHeader: string | null;
+      try {
+        const response = await this.#get(pathArg, {
+          ...optionsArg, query: { ...optionsArg.query, limit: String(this.#options.pageSize), page: String(page) },
+        });
+        rows = optionsArg.rows ? optionsArg.rows(response.body) : response.body;
+        if (rows === null && optionsArg.nullIsEmpty) rows = [];
+        totalHeader = response.headers.get('x-total-count');
+      } catch (error) {
+        if (page === 1 && optionsArg.missingIsEmpty && error instanceof validation.ForgeInventoryError && error.code === 'http-404') {
+          return { items, failure: null };
+        }
+        return { items, failure: reason(error) };
+      }
+      if (!Array.isArray(rows) || rows.length > this.#options.pageSize) return { items, failure: 'invalid-page' };
+      if (totalHeader !== null) {
+        let pageTotal: bigint;
+        try { pageTotal = BigInt(validation.decimal(totalHeader)); } catch { return { items, failure: 'invalid-total-count' }; }
+        if (total !== null && pageTotal !== total) return { items, failure: 'total-changed' };
+        total = pageTotal;
+      }
+      if (rows.length === 0) break;
+      const signature = JSON.stringify(rows);
+      if (signature === previousPage) return { items, failure: 'repeated-page' };
+      previousPage = signature;
+      items.push(...rows);
+      if (total !== null && BigInt(items.length) >= total) break;
+    }
+    if (total !== null && BigInt(items.length) !== total) return { items, failure: 'count-mismatch' };
+    return { items, failure: null };
+  }
+
+  #get(pathArg: string, optionsArg: Pick<IListOptions, 'query' | 'sudo' | 'signal'>) {
+    const url = new URL(`${this.#options.baseUrl}/api/v1${pathArg}`);
+    for (const [key, value] of Object.entries(optionsArg.query ?? {})) url.searchParams.set(key, value);
+    const request: IForgeRequestOptions = { signal: optionsArg.signal };
+    if (optionsArg.sudo !== undefined) request.headers = { sudo: optionsArg.sudo };
+    return this.#client.request(url, request);
+  }
+}
+
+/** Repository-shaped groups, summed over repositories. */
+const sumGroup = <TGroup extends Record<keyof TGroup, TMeasure>>(groupsArg: TGroup[], keysArg: Array<keyof TGroup>, missingArg: TMeasure[]): TGroup =>
+  Object.fromEntries(keysArg.map((keyArg) => [keyArg, sumMeasures([...groupsArg.map((groupArg) => groupArg[keyArg]), ...missingArg])])) as TGroup;
+
+const indicator = (measureArg: TMeasure, predicateArg: (valueArg: bigint) => boolean): TMeasure =>
+  measureArg.status === 'complete' ? complete(predicateArg(BigInt(measureArg.value)) ? 1 : 0)
+  : measureArg.status === 'partial' ? partial(predicateArg(BigInt(measureArg.observedValue)) ? 1 : 0, measureArg.reason) : measureArg;
+
+/** Every measure of a document with its dotted path. */
+const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: string; measure: TMeasure }>) => {
+  if (!valueArg || typeof valueArg !== 'object') return;
+  const value = valueArg as Record<string, unknown>;
+  if (typeof value.status === 'string' && (value.status === 'complete' || value.status === 'partial' || value.status === 'notMeasured')) {
+    outArg.push({ path: pathArg, measure: value as TMeasure });
+    return;
+  }
+  for (const [key, child] of Object.entries(value)) {
+    // Package counts are keyed by their type rather than their position.
+    const name = Array.isArray(value) && child && typeof child === 'object' && typeof (child as { type?: unknown }).type === 'string'
+      ? (child as { type: string }).type : key;
+    measuresOf(child, pathArg ? `${pathArg}.${name}` : name, outArg);
+  }
+};
+
+/**
+ * Composes the deterministic inventory from a discovery and its unit results.
+ * Repeated results for one unit keep the last. Units without a successful
+ * result, owner repository counts that disagree with discovery, and every
+ * partial or unmeasured value make the inventory incomplete, with reasons
+ * aggregated per subject kind, path and reason.
+ */
+export const composeGiteaSourceInventory = (
+  discoveryArg: IDiscovery,
+  resultsArg: TUnitResult[],
+  generatorsArg: plugins.fossInterfaces.data.IForgeSourceInventoryGenerator[],
+): IInventory => {
+  const results = new Map<string, TUnitResult>();
+  for (const result of resultsArg) {
+    const unit: TUnit = result.kind === 'failed' ? result.unit : result.kind === 'instance' ? { kind: 'instance' }
+      : result.kind === 'owner' ? { kind: 'owner', ownerKind: result.owner.kind, name: result.owner.name }
+      : { kind: 'repository', owner: result.repository.owner, name: result.repository.name };
+    results.set(unitKey(unit), result);
+  }
+  const reasons = new Map<string, number>();
+  const addReason = (textArg: string) => reasons.set(textArg, (reasons.get(textArg) ?? 0) + 1);
+  for (const text of discoveryArg.incompleteReasons) addReason(text);
+
+  const instanceResult = results.get('instance');
+  let instance: IInstance;
+  if (instanceResult?.kind === 'instance') {
+    instance = instanceResult.instance;
+  } else {
+    const missing = notMeasured(instanceResult?.kind === 'failed' ? `The instance unit failed: ${instanceResult.reason}.` : 'The instance unit was not measured.');
+    instance = {
+      users: { total: missing, active: missing, admins: missing, restricted: missing, prohibitLogin: missing, externalAuth: missing, twoFactor: missing },
+      organizations: missing, systemWebhooks: missing, runners: missing, unadoptedRepositories: missing,
+    };
+  }
+
+  const owners: TOwner[] = [];
+  const failedOwners: string[] = [];
+  for (const owner of discoveryArg.owners) {
+    const result = results.get(unitKey({ kind: 'owner', ownerKind: owner.kind, name: owner.name }));
+    if (result?.kind === 'owner') owners.push(result.owner);
+    else {
+      failedOwners.push(owner.name);
+      addReason(`${owner.kind}: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : 'unit not measured'}`);
+    }
+  }
+  const repositories: IRepository[] = [];
+  const failedRepositories: string[] = [];
+  for (const repository of discoveryArg.repositories) {
+    const result = results.get(unitKey({ kind: 'repository', ...repository }));
+    if (result?.kind === 'repository') repositories.push(result.repository);
+    else {
+      failedRepositories.push(`${repository.owner}/${repository.name}`);
+      addReason(`repository: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : 'unit not measured'}`);
+    }
+  }
+  owners.sort((aArg, bArg) => compareText(aArg.kind, bArg.kind) || compareText(aArg.name, bArg.name));
+  repositories.sort((aArg, bArg) => compareText(aArg.owner, bArg.owner) || compareText(aArg.name, bArg.name));
+
+  // Each owner's own repository listing must agree with the instance-wide discovery.
+  const discoveredPerOwner = new Map<string, number>();
+  for (const repository of discoveryArg.repositories) discoveredPerOwner.set(repository.owner, (discoveredPerOwner.get(repository.owner) ?? 0) + 1);
+  for (const owner of owners) {
+    if (owner.repositories.status === 'complete' && owner.repositories.value !== String(discoveredPerOwner.get(owner.name) ?? 0)) {
+      addReason(`${owner.kind}: repositories: the owner listing disagrees with the instance-wide repository search`);
+    }
+  }
+  const ownerNames = new Set(discoveryArg.owners.map((ownerArg) => ownerArg.name));
+  for (const owner of discoveredPerOwner.keys()) {
+    if (!ownerNames.has(owner)) addReason('repository: owner missing from the owner discovery');
+  }
+
+  const missingOwners = failedOwners.length ? [partial(0, `Owner units not measured: ${failedOwners.length}.`)] : [];
+  const missingRepositories = failedRepositories.length ? [partial(0, `Repository units not measured: ${failedRepositories.length}.`)] : [];
+  const repositoryCount = (predicateArg: (repositoryArg: IRepository) => boolean) =>
+    sumMeasures([complete(repositories.filter(predicateArg).length), ...missingRepositories]);
+  const organizationOwners = owners.filter((ownerArg): ownerArg is plugins.fossInterfaces.data.IForgeSourceOrganizationInventory => ownerArg.kind === 'organization');
+  const userOwners = owners.filter((ownerArg): ownerArg is plugins.fossInterfaces.data.IForgeSourceUserInventory => ownerArg.kind === 'user');
+  const ownerSum = (measuresArg: TMeasure[]) => sumMeasures([...measuresArg, ...missingOwners]);
+  const packageTypes = new Map<string, IPackageTypeCounts[]>();
+  for (const owner of owners) for (const counts of owner.packages) packageTypes.set(counts.type, [...packageTypes.get(counts.type) ?? [], counts]);
+
+  const inventory: Omit<IInventory, 'inventoryComplete' | 'incompleteReasons'> = {
+    generators: [...generatorsArg].sort((aArg, bArg) => compareText(aArg.package, bArg.package)),
+    source: discoveryArg.source,
+    reader: discoveryArg.reader,
+    limitations: [...giteaSourceInventoryLimitations],
+    instance,
+    owners,
+    repositories,
+    totals: {
+      organizations: instance.organizations,
+      users: instance.users.total,
+      repositories: {
+        total: repositoryCount(() => true),
+        private: repositoryCount((repositoryArg) => repositoryArg.visibility === 'private'),
+        internal: repositoryCount((repositoryArg) => repositoryArg.visibility === 'internal'),
+        forks: repositoryCount((repositoryArg) => repositoryArg.fork),
+        mirrors: repositoryCount((repositoryArg) => repositoryArg.mirror),
+        templates: repositoryCount((repositoryArg) => repositoryArg.template),
+        archived: repositoryCount((repositoryArg) => repositoryArg.archived),
+        empty: repositoryCount((repositoryArg) => repositoryArg.empty),
+        withWiki: sumMeasures([...repositories.map((repositoryArg) => indicator(repositoryArg.wikiPages, (valueArg) => valueArg > 0n)), ...missingRepositories]),
+      },
+      git: sumGroup(repositories.map((repositoryArg) => repositoryArg.git), ['reportedSizeKiB', 'branches', 'tags', 'pullRequestRefs', 'otherRefs'], missingRepositories),
+      lfs: sumGroup(repositories.map((repositoryArg) => repositoryArg.lfs), ['objects', 'bytes'], missingRepositories),
+      collaboration: sumGroup(repositories.map((repositoryArg) => repositoryArg.collaboration),
+        ['issues', 'pullRequests', 'comments', 'reviews', 'reviewComments', 'labels', 'milestones', 'reactions', 'attachments', 'attachmentBytes'], missingRepositories),
+      releases: sumGroup(repositories.map((repositoryArg) => repositoryArg.releases), ['releases', 'drafts', 'assets', 'assetBytes'], missingRepositories),
+      wikiPages: sumMeasures([...repositories.map((repositoryArg) => repositoryArg.wikiPages), ...missingRepositories]),
+      access: sumGroup(repositories.map((repositoryArg) => repositoryArg.access),
+        ['collaborators', 'teams', 'deployKeys', 'webhooks', 'branchProtections', 'tagProtections', 'pushMirrors'], missingRepositories),
+      actions: sumGroup(repositories.map((repositoryArg) => repositoryArg.actions),
+        ['workflows', 'secrets', 'variables', 'runners', 'runs', 'artifacts', 'artifactBytes'], missingRepositories),
+      owners: {
+        webhooks: ownerSum(owners.map((ownerArg) => ownerArg.webhooks)),
+        actionsSecrets: ownerSum(organizationOwners.map((ownerArg) => ownerArg.actionsSecrets)),
+        actionsVariables: ownerSum(owners.map((ownerArg) => ownerArg.actionsVariables)),
+        runners: ownerSum(owners.map((ownerArg) => ownerArg.runners)),
+        members: ownerSum(organizationOwners.map((ownerArg) => ownerArg.members)),
+        teams: ownerSum(organizationOwners.map((ownerArg) => ownerArg.teams)),
+        teamMemberships: ownerSum(organizationOwners.map((ownerArg) => ownerArg.teamMemberships)),
+        teamRepositoryGrants: ownerSum(organizationOwners.map((ownerArg) => ownerArg.teamRepositoryGrants)),
+        labels: ownerSum(organizationOwners.map((ownerArg) => ownerArg.labels)),
+        sshKeys: ownerSum(userOwners.map((ownerArg) => ownerArg.sshKeys)),
+        gpgKeys: ownerSum(userOwners.map((ownerArg) => ownerArg.gpgKeys)),
+      },
+      packages: [...packageTypes.entries()].sort(([aArg], [bArg]) => compareText(aArg, bArg)).map(([type, countsArg]) => ({
+        type,
+        ...sumGroup(countsArg.map(({ type: _type, ...measures }) => measures), ['packages', 'versions', 'files', 'bytes'], missingOwners),
+      })),
+    },
+  };
+
+  // Every value that is not complete is a reason, aggregated per subject kind, path and reason.
+  const collected: Array<{ path: string; measure: TMeasure }> = [];
+  measuresOf(instance, 'instance', collected);
+  for (const owner of owners) {
+    const { name: _name, id: _id, ...measures } = owner;
+    measuresOf(measures, owner.kind, collected);
+  }
+  for (const repository of repositories) measuresOf(repository, 'repository', collected);
+  for (const { path, measure } of collected) {
+    if (measure.status !== 'complete') addReason(`${path}: ${measure.reason}`);
+  }
+  const incompleteReasons = [...reasons.entries()]
+    .map(([text, count]) => count > 1 ? `${text} (${count} times)` : text)
+    .sort(compareText);
+  return { ...inventory, inventoryComplete: incompleteReasons.length === 0, incompleteReasons };
+};