@foss.global/codefeed 4.0.0 → 4.2.0

package/changelog.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 2026-10-15 - 4.2.0
+
+### Features
+
+- Record source releases and protection rules in the Gitea source inventory, and download release assets (giteasourceinventory, giteasourcetransfer)
+  - A repository carries `releaseRecords`: every release, drafts and prereleases included, sorted by numeric id, with an author snapshot and its assets (id, uuid, name, size, download count, creation time) sorted by numeric id. Null while a release count is not complete. No digest: Gitea exposes none.
+  - A repository carries `protections`: branch rules sorted by rule name with every restriction Gitea reads back, and tag rules sorted by numeric id with their pattern and allowlist. Null while either protection count is not complete.
+  - `GiteaSourceTransfer.downloadReleaseAsset(repository, releaseId, { id, uuid, name, size }, { signal })` reads the repository by id and the release by id before the download and again after its last byte, then streams `GET /attachments/{uuid}` with the `token` authorization: no redirect, no range, exact size, the last chunk held back until size and both identity reads pass. Codes: `release-asset-invalid`, `release-asset-identity-changed`, `release-asset-size-mismatch`, `release-asset-size-overrun`, `release-asset-short-body`, `release-asset-transfer-timed-out`, `release-asset-download-failed`, `release-asset-transfer-failed` (body bytes arriving after the download ended; only after the stream is destroyed, so a reader does not see it), `http-<status>`. New option `releaseAssetTimeoutMs` (default 30 minutes, at most six hours).
+  - The LFS client's transfer bounds and last-chunk hold-back moved to a shared internal module; LFS codes are unchanged.
+  - require @foss.global/interfaces ^2.7.0 for `IForgeSourceRelease`, `IForgeSourceRepositoryProtections` and the optional `releaseRecords` and `protections`
+  - Upgrade: additive. A repository unit now also fails when a release or protection rule lacks a field Gitea 1.27 always sends. Rollback: reports from older readers carry no `releaseRecords` or `protections`, and older readers have no `downloadReleaseAsset`.
+
+### Fixes
+
+- Destroying an LFS download stream while a read is pending now ends the download and closes its connection at once (lfsbatchclient)
+  - The stream came from `Readable.from`, whose destroy waits for the pending read, so a stalled download kept its connection until `requestTimeoutMs`. LFS and release asset downloads now share a stream whose destroy aborts the request immediately; error codes are unchanged.
+### Maintenance
+
+- Upgrade @git.zone/tsbundle to ^3.4.0 (release tooling currency)
+
+## 2026-10-14 - 4.1.0
+
+### Features
+
+- Record each source repository's id in Gitea source discovery, check it when measuring, and look a repository up by id (giteasourceinventory)
+  - `discover()` records each repository's `id` (canonical decimal string) and `units()` passes it into the repository unit.
+  - A repository unit with an `id` fails with `repository-identity-changed` when its name answers with another id; a unit without one is checked by name only, as before.
+  - `composeGiteaSourceInventory` counts a repository result whose id differs from discovery's as a failed unit (`repository: unit failed: repository-identity-changed`) and adds `repository: duplicate-id` when two measured repositories share one id.
+  - `lookupRepository(id)` reads `GET /api/v1/repositories/{id}`: `present` with the current owner and name, or `absent` only on 404; other failures reject, and a non-canonical id rejects with `invalid-repository-id`.
+  - require @foss.global/interfaces ^2.6.0 for the optional discovery and unit `id`
+  - Upgrade: additive; discoveries and units without ids keep working. Rollback: an older reader ignores stored ids and checks repository units by name only.
+
 ## 2026-10-14 - 4.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/codefeed',
-    version: '4.0.0',
+    version: '4.2.0',
     description: 'The @foss.global/codefeed module generates commit/activity feeds from forge providers including Gitea and GitManager.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx1QkFBdUI7SUFDN0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHVIQUF1SDtDQUNySSxDQUFBIn0=

package/dist_ts/classes.giteasourceinventory.d.ts

@@ -39,6 +39,16 @@ export interface IGiteaSourceMeasureOptions {
     /** Called once per unit as soon as its result exists, for example to persist it. */
     onResult?: (resultArg: TUnitResult) => void | Promise<void>;
 }
+/** A repository read by its id: the name Gitea gives it now, or `absent` once it is deleted. */
+export type TGiteaSourceRepositoryLookup = {
+    status: 'present';
+    id: string;
+    owner: string;
+    name: string;
+} | {
+    status: 'absent';
+    id: string;
+};
 /** The only limitation: data Gitea exposes to no administrator read and that the migration reissues. */
 export declare const giteaSourceInventoryLimitations: readonly string[];
 /**
@@ -57,15 +67,28 @@ export declare class GiteaSourceInventory {
     /** REST and LFS batch requests together. */
     get metrics(): IForgeRequestMetrics;
     /**
-     * Identifies the source and its reader and lists every owner and repository.
-     * Rejects unless the token belongs to a site administrator; a listing that
+     * Identifies the source and its reader and lists every owner and repository
+     * with its id. Rejects unless the token belongs to a site administrator; a listing that
      * does not finish, or that lists a repository id twice, is reported in
      * `incompleteReasons`.
      */
     discover(signalArg?: AbortSignal): Promise<IDiscovery>;
     /** Every unit a run over this discovery measures: the instance, then owners, then repositories. */
     units(discoveryArg: IDiscovery): TUnit[];
-    /** Measures one unit. Never rejects: a unit whose primary record cannot be read is `failed`. */
+    /**
+     * Reads a repository by its id through `GET /repositories/{id}`, which
+     * keeps answering after a rename or transfer: `present` with the name Gitea
+     * gives it now, or `absent` when Gitea answers 404, which a site
+     * administrator only gets for a deleted repository. Any other failed read
+     * rejects with its error, so it never counts as a deletion; an id that is not
+     * a canonical decimal rejects with `invalid-repository-id`.
+     */
+    lookupRepository(idArg: string, signalArg?: AbortSignal): Promise<TGiteaSourceRepositoryLookup>;
+    /**
+     * Measures one unit. Never rejects: a unit whose primary record cannot be
+     * read is `failed`, and so is a repository unit carrying an id that its name
+     * no longer answers with (`repository-identity-changed`).
+     */
     measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult>;
     /**
      * Measures units with bounded concurrency; results keep the order of `unitsArg`.
@@ -77,9 +100,10 @@ export declare class GiteaSourceInventory {
 /**
  * Composes the deterministic inventory from a discovery and its unit results.
  * Repeated results for one unit keep the last. Units without a successful
- * result, owner repository counts that disagree with discovery, and every
- * partial or unmeasured value make the inventory incomplete, with reasons
- * aggregated per subject kind, path and reason.
+ * result, a repository result for another id than discovery recorded, two
+ * repositories measured with one id, owner repository counts that disagree
+ * with discovery, and every partial or unmeasured value make the inventory
+ * incomplete, with reasons aggregated per subject kind, path and reason.
  */
 export declare const composeGiteaSourceInventory: (discoveryArg: IDiscovery, resultsArg: TUnitResult[], generatorsArg: plugins.fossInterfaces.data.IForgeSourceInventoryGenerator[]) => IInventory;
 export {};