@foss.global/codefeed 5.0.0 → 5.2.0

package/changelog.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 2026-11-11 - 5.2.0
+
+### Features
+
+- inventory packages one unit per package when the run selects the package class, with their distinct content (giteasourceinventory)
+  - `discover(signal, { classes: ['packages'] })` lists every package from `/admin/packages` as `discovery.packages`, and `units()` adds a `package` unit per package; without the class nothing changes and the package class is unread. An unknown class rejects with `invalid-options`.
+  - A package unit records an `IForgeSourcePackageInventory`: owner id, linked repository, every version and each distinct file content once with its files, from the v1 package API. Container index candidates (a file list of exactly `manifest.json`) are read by digest from the registry, checked by SHA-256 and the index or manifest-list media type (`unexpected-manifest-shape` otherwise), and record their `references`; no other manifest is read. npm packages record every served dist-tag, a derived `latest` included, and each version's deprecation; Cargo versions their yank from the sparse index.
+  - A unit is whole or failed, never truncated: a listing that does not finish, `npm-version-missing`, `cargo-index-incomplete`, `package-identity-changed` and `unit-over-bound` (over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON) fail it.
+  - `composeGiteaSourceInventory` adds `packages` and `totals.packageContent` exactly when discovery lists packages, an empty list included; `composeGiteaPackageContent` is exported as the pure function behind the content figures. Unit kinds are dispatched exhaustively; an unknown kind fails as `unit-kind-unsupported`.
+  - Every read is a GET; reading an index counts a download of its version, an accepted read stamp (S10 ruling, Addenda 1 and 2).
+  - require @foss.global/interfaces ^3.2.1
+- read package content for the migration (giteasourcetransfer)
+  - `readContainerManifest` returns a manifest's exact bytes and `Content-Type`, checked against its digest; `downloadContainerBlob` streams a config or layer verified by SHA-256 and size.
+  - `downloadPackageFile` streams a generic file, npm tarball, Swift archive or crate, and `readPackageDocument` returns an npm version document, Swift release metadata or `Package.swift`, or a crate version's sparse index line, with its SHA-256; both are bracketed by identity reads of the version (`package-version-identity-changed`, `http-404`). The new option `packageTransferTimeoutMs` bounds a download.
+- `ForgeRequestClient.requestBytes` reads a body as the bytes that arrived with the declared media type (forgeinventory)
+
+### Tests
+
+- Check every package record field for field against @foss.global/forgefixtures ^1.0.0 on Gitea 28.2.0, the distinct content against an independent computation, every transfer read, and, with the fixture's state snapshots, that the package inventory and transfer reads change nothing but `package_version.download_count` (once per lead-file read) and the administrator token's `access_token.updated_unix` (giteasourceinventory, giteasourcetransfer)
+- Check the package class selection, index candidates, `unexpected-manifest-shape`, `unit-over-bound`, the npm, Cargo and listing failures, composition and the pure content function against a mocked Gitea, and the package transfer's digest, size, media type and identity checks against a local HTTPS server (giteasourceinventory, giteasourcetransfer)
+
+## 2026-11-11 - 5.1.0
+
+### Features
+
+- record users, teams and repository access in the Gitea source inventory, and count deploy tokens apart from SSH deploy keys (giteasourceinventory)
+  - A user owner records `userRecord`: id, login, the active, admin, restricted and prohibit-login flags, visibility, and every SSH key from `/users/{user}/keys` with id, title, fingerprint, OpenSSH key type and public key. Null while `sshKeys` is not complete.
+  - An organization records `teamRecords`: every team with its permission, units map, includes-all and create-repository flags, visibility, members by id and login and repository ids, from `/orgs/{org}/teams`, `/teams/{id}/members` and `/teams/{id}/repos`. Null while a team listing is not complete.
+  - A repository records `accessRecords`: its collaborators with one `/collaborators/{user}/permission` read each (the effective permission Gitea reports, never the collaboration's own mode), its SSH deploy keys (id, shared key row id, title, fingerprint, public key, read-only) and its deploy tokens (id, title, read-only; never the token or its mask). Null while any of its counts is not complete; a failed permission read makes `access.collaborators` partial with `collaborator-permission: <code>`.
+  - Count meaning change: `access.deployKeys` (and its total) counts SSH deploy keys only; Gitea 28 deploy tokens, which 5.0.0 counted there, are counted by the new `access.deployTokens`. Composing a stored repository result from before 5.1.0 counts its `deployTokens` as not measured, so the inventory stays incomplete until the repository is measured again.
+  - A deploy key entry whose `key_type` is neither `ssh` nor `token`, or a team without Gitea 28's `visibility`, fails its unit.
+  - require @foss.global/interfaces ^3.1.0
+  - Upgrade: additive fields; re-run the inventory to record them. A consumer that summed `deployKeys` as all deploy key entries adds `deployTokens`. Rollback: 5.0.0 records none of them and counts deploy tokens as deploy keys.
+
+### Tests
+
+- Check the identity records against @foss.global/forgefixtures ^0.7.0 on Gitea 28.2.0: every user with its SSH keys (Ed25519, RSA, ECDSA and `sk-*`), every team including Owners and the granular, includes-all and create-repository teams, every collaborator's effective permission, shared, read-write and read-only SSH deploy keys and deploy tokens, with no token mask in the report (giteasourceinventory)
+- Check paging of collaborators, team members and SSH keys, null records on a failed page, a failed or mismatched permission read and an unknown access mode, the deploy key and token split, an unknown deploy key type, and composition of a stored result without `deployTokens` (giteasourceinventory)
+
 ## 2026-11-11 - 5.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/codefeed',
-    version: '5.0.0',
+    version: '5.2.0',
     description: 'The @foss.global/codefeed module generates commit/activity feeds from forge providers including Gitea and GitManager.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx1QkFBdUI7SUFDN0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHVIQUF1SDtDQUNySSxDQUFBIn0=

package/dist_ts/classes.giteasourceinventory.d.ts

@@ -32,6 +32,17 @@ export interface IGiteaSourceInventoryOptions {
     requestTimeoutMs?: number;
     maxResponseBytes?: number;
 }
+/** A class of source data a run measures only when its discovery selects it. */
+export type TGiteaSourceInventoryClass = 'packages';
+export interface IGiteaSourceDiscoveryOptions {
+    /**
+     * Classes beside the instance, owners and repositories to list for
+     * measurement. `packages` lists every package, so `units` measures one unit
+     * per package; without it, discovery carries no `packages` and the package
+     * class is unread.
+     */
+    classes?: readonly TGiteaSourceInventoryClass[];
+}
 export interface IGiteaSourceMeasureOptions {
     signal?: AbortSignal;
     /** Units measured at the same time. Requests within one unit are sequential. */
@@ -53,9 +64,10 @@ export type TGiteaSourceRepositoryLookup = {
 export declare const giteaSourceInventoryLimitations: readonly string[];
 /**
  * Authenticated, read-only inventory of a Gitea instance, read with a site
- * administrator's token: GET requests to its REST API, a mirror clone of every
- * repository for refs, objects and LFS pointers, and LFS batch `download`
- * requests that check which referenced objects Gitea holds. It counts secrets
+ * administrator's token: GET requests to its REST API and package registries,
+ * a mirror clone of every repository for refs, objects and LFS pointers, and
+ * LFS batch `download` requests that check which referenced objects Gitea
+ * holds. It counts secrets
  * and variables without retaining their values, and reports every read that
  * did not finish as a partial or unmeasured value instead of a count.
  */
@@ -68,12 +80,18 @@ export declare class GiteaSourceInventory {
     get metrics(): IForgeRequestMetrics;
     /**
      * Identifies the source and its reader and lists every owner and repository
-     * with its id. Rejects unless the token belongs to a site administrator; a listing that
-     * does not finish, or that lists a repository id twice, is reported in
-     * `incompleteReasons`.
+     * with its id, and with `classes: ['packages']` every package from the
+     * administrator package listing (`packages`, absent otherwise). Rejects
+     * unless the token belongs to a site administrator, and rejects an unknown
+     * class with `invalid-options`; a listing that does not finish, or that
+     * lists a repository id twice, is reported in `incompleteReasons`.
+     */
+    discover(signalArg?: AbortSignal, optionsArg?: IGiteaSourceDiscoveryOptions): Promise<IDiscovery>;
+    /**
+     * Every unit a run over this discovery measures: the instance, then owners,
+     * then repositories, then the packages discovery lists when it selected
+     * them.
      */
-    discover(signalArg?: AbortSignal): Promise<IDiscovery>;
-    /** Every unit a run over this discovery measures: the instance, then owners, then repositories. */
     units(discoveryArg: IDiscovery): TUnit[];
     /**
      * Reads a repository by its id through `GET /repositories/{id}`, which
@@ -87,7 +105,11 @@ export declare class GiteaSourceInventory {
     /**
      * Measures one unit. Never rejects: a unit whose primary record cannot be
      * read is `failed`, and so is a repository unit carrying an id that its name
-     * no longer answers with (`repository-identity-changed`).
+     * no longer answers with (`repository-identity-changed`). A package unit is
+     * read whole or fails, never partly: a listing that does not finish, an
+     * index that is not what its file list promises (`unexpected-manifest-shape`)
+     * and a result over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON
+     * (`unit-over-bound`) fail it, and its record is never truncated.
      */
     measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult>;
     /**
@@ -104,6 +126,10 @@ export declare class GiteaSourceInventory {
  * repositories measured with one id, owner repository counts that disagree
  * with discovery, and every partial or unmeasured value make the inventory
  * incomplete, with reasons aggregated per subject kind, path and reason.
+ * `packages` and `totals.packageContent` (`composeGiteaPackageContent`) are
+ * present exactly when discovery lists packages, an empty list included; a
+ * package without a record is left out, never truncated, and makes its
+ * content measures partial.
  */
 export declare const composeGiteaSourceInventory: (discoveryArg: IDiscovery, resultsArg: TUnitResult[], generatorsArg: plugins.fossInterfaces.data.IForgeSourceInventoryGenerator[]) => IInventory;
 export {};