@foss.global/codefeed 5.0.0 → 5.2.0

package/ts/classes.giteasourceinventory.ts

@@ -4,6 +4,9 @@ import * as validation from './forgeinventory.validation.js';
 import { ForgeRequestClient } from './forgeinventory.client.js';
 import type { IForgeRequestMetrics, IForgeRequestOptions } from './forgeinventory.client.js';
 import { measureGiteaMirror } from './giteasourceinventory.git.js';
+import {
+  cargoIndexPath, comparePackages, composeGiteaPackageContent, containerIndexMediaTypes, npmPackagePath, packageKey, packageTypePattern,
+} from './giteasourceinventory.packages.js';
 
 type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
 type TUnit = plugins.fossInterfaces.data.TForgeSourceInventoryUnit;
@@ -17,6 +20,18 @@ type TRelease = plugins.fossInterfaces.data.TForgeSourceRelease;
 type IBranchProtection = plugins.fossInterfaces.data.IForgeSourceBranchProtection;
 type ITagProtection = plugins.fossInterfaces.data.IForgeSourceTagProtection;
 type IInventory = plugins.fossInterfaces.data.IForgeSourceInventory;
+type TAccessMode = plugins.fossInterfaces.data.TForgeSourceAccessMode;
+type TTeamVisibility = plugins.fossInterfaces.data.TForgeSourceTeamVisibility;
+type ITeamRecord = plugins.fossInterfaces.data.IForgeSourceTeamRecord;
+type IUserSshKey = plugins.fossInterfaces.data.IForgeSourceUserSshKey;
+type ICollaborator = plugins.fossInterfaces.data.IForgeSourceCollaborator;
+type IDeployKey = plugins.fossInterfaces.data.IForgeSourceDeployKey;
+type IDeployToken = plugins.fossInterfaces.data.IForgeSourceDeployToken;
+type IAccessCounts = plugins.fossInterfaces.data.IForgeSourceAccessCounts;
+type IPackageRef = plugins.fossInterfaces.data.IForgeSourcePackageRef;
+type IPackageRecord = plugins.fossInterfaces.data.IForgeSourcePackageInventory;
+type IPackageVersion = plugins.fossInterfaces.data.IForgeSourcePackageVersion;
+type IPackageBlob = plugins.fossInterfaces.data.IForgeSourcePackageBlob;
 
 export interface IGiteaSourceInventoryOptions {
   /** Operator-assigned identity of the source instance. */
@@ -47,6 +62,19 @@ export interface IGiteaSourceInventoryOptions {
   maxResponseBytes?: number;
 }
 
+/** A class of source data a run measures only when its discovery selects it. */
+export type TGiteaSourceInventoryClass = 'packages';
+
+export interface IGiteaSourceDiscoveryOptions {
+  /**
+   * Classes beside the instance, owners and repositories to list for
+   * measurement. `packages` lists every package, so `units` measures one unit
+   * per package; without it, discovery carries no `packages` and the package
+   * class is unread.
+   */
+  classes?: readonly TGiteaSourceInventoryClass[];
+}
+
 export interface IGiteaSourceMeasureOptions {
   signal?: AbortSignal;
   /** Units measured at the same time. Requests within one unit are sequential. */
@@ -212,6 +240,71 @@ const releaseRecord = (itemArg: unknown): TRelease => {
     : { ...release, draft: false, publishedAt: requiredTimestamp(item.published_at) };
 };
 
+const accessModes: ReadonlySet<string> = new Set<TAccessMode>(['none', 'read', 'write', 'admin', 'owner']);
+const isAccessMode = (valueArg: string): valueArg is TAccessMode => accessModes.has(valueArg);
+/** An access mode as Gitea reports it (`AccessMode.ToString`). */
+const accessMode = (valueArg: unknown): TAccessMode => {
+  if (typeof valueArg !== 'string' || !isAccessMode(valueArg)) throw new validation.ForgeInventoryError('invalid-access-mode');
+  return valueArg;
+};
+
+const teamVisibilities: ReadonlySet<string> = new Set<TTeamVisibility>(['public', 'limited', 'private']);
+const isTeamVisibility = (valueArg: string): valueArg is TTeamVisibility => teamVisibilities.has(valueArg);
+
+/** An account as a listing names it: its id and login. */
+const account = (itemArg: unknown): { id: string; login: string } => {
+  const item = validation.record(itemArg);
+  return { id: validation.decimal(item.id), login: segment(item.login) };
+};
+
+/** A user's public SSH key; its key type is the first field of the public key Gitea stores. */
+const userSshKey = (itemArg: unknown): IUserSshKey => {
+  const item = validation.record(itemArg);
+  const publicKey = requiredString(item.key);
+  const keyType = publicKey.split(' ')[0];
+  if (!/^[A-Za-z0-9][A-Za-z0-9@._+-]{0,127}$/.test(keyType)) throw new validation.ForgeInventoryError('invalid-ssh-key');
+  return { id: validation.decimal(item.id), title: text(item.title), fingerprint: requiredString(item.fingerprint), keyType, publicKey };
+};
+
+/**
+ * A team as Gitea 28 reads it, with the members and repositories its listings
+ * returned. A whole-repository team has a null units map; units sort by name.
+ */
+const teamRecord = (teamArg: Record<string, unknown>, membersArg: unknown[], repositoriesArg: unknown[]): ITeamRecord => {
+  if (typeof teamArg.visibility !== 'string' || !isTeamVisibility(teamArg.visibility)) throw new validation.ForgeInventoryError('invalid-visibility');
+  return {
+    id: validation.decimal(teamArg.id),
+    name: requiredString(teamArg.name),
+    permission: accessMode(teamArg.permission),
+    unitsMap: teamArg.units_map === null ? null : Object.fromEntries(Object.entries(validation.record(teamArg.units_map))
+      .map(([unitArg, modeArg]) => [unitArg, accessMode(modeArg)] as const)
+      .sort(([aArg], [bArg]) => compareText(aArg, bArg))),
+    includesAllRepositories: requiredBoolean(teamArg.includes_all_repositories),
+    canCreateOrgRepo: requiredBoolean(teamArg.can_create_org_repo),
+    visibility: teamArg.visibility,
+    members: membersArg.map(account).sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id)),
+    repositoryIds: repositoriesArg.map((repositoryArg) => validation.decimal(validation.record(repositoryArg).id)).sort(compareDecimal),
+  };
+};
+
+/**
+ * One entry of a repository's deploy key listing, which on Gitea 28 holds SSH
+ * deploy keys and deploy tokens (`key_type`). A token's key and fingerprint
+ * (its mask) are never read.
+ */
+const deployKeyEntry = (itemArg: unknown): { kind: 'ssh'; key: IDeployKey } | { kind: 'token'; token: IDeployToken } => {
+  const item = validation.record(itemArg);
+  const id = validation.decimal(item.id);
+  const title = text(item.title);
+  const readOnly = requiredBoolean(item.read_only);
+  if (item.key_type === 'token') return { kind: 'token', token: { id, title, readOnly } };
+  if (item.key_type !== 'ssh') throw new validation.ForgeInventoryError('invalid-deploy-key-type');
+  return {
+    kind: 'ssh',
+    key: { id, keyId: validation.decimal(item.key_id), title, fingerprint: requiredString(item.fingerprint), publicKey: requiredString(item.key), readOnly },
+  };
+};
+
 const allowlist = (usernamesArg: unknown, teamsArg: unknown) => ({ usernames: texts(usernamesArg), teams: texts(teamsArg) });
 
 /** A branch protection rule with every restriction Gitea reads back. */
@@ -266,16 +359,56 @@ const countedEnvelope = (bodyArg: unknown, rowsKeyArg: string): { rows: unknown[
   return { rows, failure: validation.decimal(body.total_count) === String(rows.length) ? null : 'count-mismatch' };
 };
 
-const unitKey = (unitArg: TUnit): string => unitArg.kind === 'instance' ? 'instance'
-  : unitArg.kind === 'owner' ? `owner:${unitArg.ownerKind}:${unitArg.name}` : `repository:${unitArg.owner}/${unitArg.name}`;
+/** The unit a result answers. */
+const resultUnit = (resultArg: TUnitResult): TUnit => {
+  switch (resultArg.kind) {
+    case 'failed': return resultArg.unit;
+    case 'instance': return { kind: 'instance' };
+    case 'owner': return { kind: 'owner', ownerKind: resultArg.owner.kind, name: resultArg.owner.name };
+    case 'repository': return { kind: 'repository', owner: resultArg.repository.owner, name: resultArg.repository.name };
+    case 'package': return { kind: 'package', owner: resultArg.package.owner, type: resultArg.package.type, name: resultArg.package.name };
+    default: return unknownUnit(resultArg);
+  }
+};
+
+/** Refuses a unit kind this generator does not know, which a newer contract may add. */
+const unknownUnit = (unitArg: never): never => {
+  void unitArg;
+  throw new validation.ForgeInventoryError('unit-kind-unsupported');
+};
+
+const unitKey = (unitArg: TUnit): string => {
+  switch (unitArg.kind) {
+    case 'instance': return 'instance';
+    case 'owner': return `owner:${unitArg.ownerKind}:${unitArg.name}`;
+    case 'repository': return `repository:${unitArg.owner}/${unitArg.name}`;
+    case 'package': return `package:${packageKey(unitArg)}`;
+    default: return unknownUnit(unitArg);
+  }
+};
+
+/** A package type from a listing. */
+const packageType = (valueArg: unknown): string => {
+  const type = requiredString(valueArg);
+  if (!packageTypePattern.test(type)) throw new validation.ForgeInventoryError('invalid-package-type');
+  return type;
+};
+
+/** A package name as Gitea stores it; container and npm names may hold `/`, so it is no single path segment. */
+const packageName = (valueArg: unknown): string => {
+  const name = requiredString(valueArg);
+  if (name.length > 512 || /[\u0000-\u001f\u007f]/.test(name)) throw new validation.ForgeInventoryError('invalid-package-name');
+  return name;
+};
 
 const compareText = (aArg: string, bArg: string): number => aArg < bArg ? -1 : aArg > bArg ? 1 : 0;
 
 /**
  * Authenticated, read-only inventory of a Gitea instance, read with a site
- * administrator's token: GET requests to its REST API, a mirror clone of every
- * repository for refs, objects and LFS pointers, and LFS batch `download`
- * requests that check which referenced objects Gitea holds. It counts secrets
+ * administrator's token: GET requests to its REST API and package registries,
+ * a mirror clone of every repository for refs, objects and LFS pointers, and
+ * LFS batch `download` requests that check which referenced objects Gitea
+ * holds. It counts secrets
  * and variables without retaining their values, and reports every read that
  * did not finish as a partial or unmeasured value instead of a count.
  */
@@ -339,11 +472,15 @@ export class GiteaSourceInventory {
 
   /**
    * Identifies the source and its reader and lists every owner and repository
-   * with its id. Rejects unless the token belongs to a site administrator; a listing that
-   * does not finish, or that lists a repository id twice, is reported in
-   * `incompleteReasons`.
+   * with its id, and with `classes: ['packages']` every package from the
+   * administrator package listing (`packages`, absent otherwise). Rejects
+   * unless the token belongs to a site administrator, and rejects an unknown
+   * class with `invalid-options`; a listing that does not finish, or that
+   * lists a repository id twice, is reported in `incompleteReasons`.
    */
-  public async discover(signalArg?: AbortSignal): Promise<IDiscovery> {
+  public async discover(signalArg?: AbortSignal, optionsArg: IGiteaSourceDiscoveryOptions = {}): Promise<IDiscovery> {
+    const classes = optionsArg.classes ?? [];
+    if (!Array.isArray(classes) || classes.some((classArg) => classArg !== 'packages')) throw new validation.ForgeInventoryError('invalid-options');
     const reader = validation.record((await this.#get('/user', { signal: signalArg })).body);
     if (reader.is_admin !== true) throw new validation.ForgeInventoryError('reader-not-site-admin');
     const version = validation.record((await this.#get('/version', { signal: signalArg })).body).version;
@@ -380,16 +517,34 @@ export class GiteaSourceInventory {
     }
     if (ids.size !== repositories.items.length) incompleteReasons.push('discovery: repositories: duplicate-id');
     discovered.sort((aArg, bArg) => compareText(aArg.owner, bArg.owner) || compareText(aArg.name, bArg.name));
+    let packages: IPackageRef[] | undefined;
+    if (classes.includes('packages')) {
+      // One row per package version, of every owner, user-owned packages included.
+      const versions = await this.#list('/admin/packages', { signal: signalArg });
+      if (versions.failure !== null) incompleteReasons.push(`discovery: packages: ${versions.failure}`);
+      const refs = new Map<string, IPackageRef>();
+      for (const itemArg of versions.items) {
+        const item = validation.record(itemArg);
+        const ref = { owner: segment(validation.record(item.owner).login), type: packageType(item.type), name: packageName(item.name) };
+        refs.set(packageKey(ref), ref);
+      }
+      packages = [...refs.values()].sort(comparePackages);
+    }
     return {
       source: { instanceId: this.#options.instanceId, kind: 'gitea', baseUrl: this.#options.baseUrl, version },
       reader: { login: segment(reader.login), siteAdmin: true },
       owners,
       repositories: discovered,
+      ...(packages === undefined ? {} : { packages }),
       incompleteReasons: incompleteReasons.sort(compareText),
     };
   }
 
-  /** Every unit a run over this discovery measures: the instance, then owners, then repositories. */
+  /**
+   * Every unit a run over this discovery measures: the instance, then owners,
+   * then repositories, then the packages discovery lists when it selected
+   * them.
+   */
   public units(discoveryArg: IDiscovery): TUnit[] {
     return [
       { kind: 'instance' },
@@ -397,6 +552,7 @@ export class GiteaSourceInventory {
       ...discoveryArg.repositories.map((repositoryArg): TUnit => ({
         kind: 'repository', owner: repositoryArg.owner, name: repositoryArg.name, ...repositoryArg.id === undefined ? {} : { id: repositoryArg.id },
       })),
+      ...(discoveryArg.packages ?? []).map((packageArg): TUnit => ({ kind: 'package', owner: packageArg.owner, type: packageArg.type, name: packageArg.name })),
     ];
   }
 
@@ -424,15 +580,31 @@ export class GiteaSourceInventory {
   /**
    * Measures one unit. Never rejects: a unit whose primary record cannot be
    * read is `failed`, and so is a repository unit carrying an id that its name
-   * no longer answers with (`repository-identity-changed`).
+   * no longer answers with (`repository-identity-changed`). A package unit is
+   * read whole or fails, never partly: a listing that does not finish, an
+   * index that is not what its file list promises (`unexpected-manifest-shape`)
+   * and a result over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON
+   * (`unit-over-bound`) fail it, and its record is never truncated.
    */
   public async measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult> {
     try {
-      if (unitArg.kind === 'instance') return { kind: 'instance', instance: await this.#instance(signalArg) };
-      if (unitArg.kind === 'owner') {
-        return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
+      switch (unitArg.kind) {
+        case 'instance':
+          return { kind: 'instance', instance: await this.#instance(signalArg) };
+        case 'owner':
+          return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
+        case 'repository':
+          return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, unitArg.id, signalArg) };
+        case 'package': {
+          const result: TUnitResult = { kind: 'package', package: await this.#package(unitArg, signalArg) };
+          if (Buffer.byteLength(JSON.stringify(result), 'utf8') > plugins.fossInterfaces.data.forgeSourceInventoryUnitMaxBytes) {
+            return { kind: 'failed', unit: unitArg, reason: 'unit-over-bound' };
+          }
+          return result;
+        }
+        default:
+          return unknownUnit(unitArg);
       }
-      return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, unitArg.id, signalArg) };
     } catch (error) {
       return { kind: 'failed', unit: unitArg, reason: reason(error) };
     }
@@ -518,13 +690,21 @@ export class GiteaSourceInventory {
     const teams = await this.#list(`${path}/teams`, { signal: signalArg });
     const memberships: TMeasure[] = [];
     const grants: TMeasure[] = [];
-    for (const team of teams.items) {
-      const teamPath = `/teams/${validation.decimal(validation.record(team).id)}`;
-      memberships.push(await this.#count(`${teamPath}/members`, { signal: signalArg }));
-      grants.push(await this.#count(`${teamPath}/repos`, { signal: signalArg }));
+    const teamRecords: ITeamRecord[] = [];
+    for (const teamArg of teams.items) {
+      const team = validation.record(teamArg);
+      const teamPath = `/teams/${validation.decimal(team.id)}`;
+      // An includes-all team lists every repository it holds like any other team.
+      const members = await this.#list(`${teamPath}/members`, { signal: signalArg });
+      const repositories = await this.#list(`${teamPath}/repos`, { signal: signalArg });
+      memberships.push(listingMeasure(members));
+      grants.push(listingMeasure(repositories));
+      teamRecords.push(teamRecord(team, members.items, repositories.items));
     }
     const teamsMeasure = listingMeasure(teams);
     const fromTeams = (measuresArg: TMeasure[]) => sumMeasures([...measuresArg, ...(teamsMeasure.status === 'complete' ? [] : [partial(0, teams.failure!)])]);
+    const teamMemberships = fromTeams(memberships);
+    const teamRepositoryGrants = fromTeams(grants);
     return {
       kind: 'organization',
       ...await this.#ownerBase(nameArg, organization, `${path}/repos`, signalArg),
@@ -533,10 +713,14 @@ export class GiteaSourceInventory {
       runners: await this.#runners(`${path}/actions/runners`, { signal: signalArg }),
       members: await this.#count(`${path}/members`, { signal: signalArg }),
       teams: teamsMeasure,
-      teamMemberships: fromTeams(memberships),
-      teamRepositoryGrants: fromTeams(grants),
+      teamMemberships,
+      teamRepositoryGrants,
       labels: await this.#count(`${path}/labels`, { signal: signalArg }),
       actionsSecrets: await this.#count(`${path}/actions/secrets`, { signal: signalArg }),
+      // Never partial: one unfinished listing makes the records null.
+      teamRecords: [teamsMeasure, teamMemberships, teamRepositoryGrants].every((measureArg) => measureArg.status === 'complete')
+        ? teamRecords.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id))
+        : null,
     };
   }
 
@@ -546,21 +730,28 @@ export class GiteaSourceInventory {
     if (segment(user.login) !== nameArg) throw new validation.ForgeInventoryError('owner-identity-changed');
     // User-scoped settings are only readable as that user, through the administrator's Sudo header.
     const sudo = { signal: signalArg, sudo: nameArg };
+    const base = await this.#ownerBase(nameArg, user, `${path}/repos`, signalArg);
+    const flags = {
+      admin: requiredBoolean(user.is_admin),
+      active: requiredBoolean(user.active),
+      restricted: requiredBoolean(user.restricted),
+      prohibitLogin: requiredBoolean(user.prohibit_login),
+    };
+    // As an administrator this lists every key of the user.
+    const sshKeys = await this.#list(`${path}/keys`, { signal: signalArg });
+    const keyRecords = sshKeys.items.map(userSshKey).sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id));
     return {
       kind: 'user',
-      ...await this.#ownerBase(nameArg, user, `${path}/repos`, signalArg),
-      account: {
-        admin: requiredBoolean(user.is_admin),
-        active: requiredBoolean(user.active),
-        restricted: requiredBoolean(user.restricted),
-        prohibitLogin: requiredBoolean(user.prohibit_login),
-        externalAuth: validation.decimal(user.source_id) !== '0',
-      },
+      ...base,
+      account: { ...flags, externalAuth: validation.decimal(user.source_id) !== '0' },
       webhooks: await this.#count('/user/hooks', sudo),
       actionsVariables: await this.#count('/user/actions/variables', sudo),
       runners: await this.#runners('/user/actions/runners', sudo),
-      sshKeys: await this.#count(`${path}/keys`, { signal: signalArg }),
+      sshKeys: listingMeasure(sshKeys),
       gpgKeys: await this.#count(`${path}/gpg_keys`, { signal: signalArg }),
+      userRecord: sshKeys.failure === null
+        ? { id: base.id, login: nameArg, active: flags.active, admin: flags.admin, restricted: flags.restricted, prohibitLogin: flags.prohibitLogin, visibility: base.visibility, sshKeys: keyRecords }
+        : null,
     };
   }
 
@@ -608,6 +799,164 @@ export class GiteaSourceInventory {
     return counts;
   }
 
+  /**
+   * One package as Gitea's v1 package API lists it: every version with its
+   * files, each distinct content once. Container index candidates, versions
+   * whose only file is `manifest.json`, are read by digest for their
+   * references; no other manifest is read. npm packages add the dist-tags Gitea
+   * serves (a derived `latest` included) and each version's deprecation,
+   * Cargo crates each version's yank from the sparse index. Every read is a
+   * GET; reading an index counts a download of its version, an accepted read
+   * stamp (S10 ruling, Addendum 1).
+   */
+  async #package(refArg: IPackageRef, signalArg?: AbortSignal): Promise<IPackageRecord> {
+    const packagePath = `/packages/${encodeURIComponent(refArg.owner)}/${encodeURIComponent(refArg.type)}/${encodeURIComponent(refArg.name)}`;
+    const listing = await this.#list(packagePath, { signal: signalArg });
+    if (listing.failure !== null) throw new validation.ForgeInventoryError(listing.failure);
+    if (listing.items.length === 0) throw new validation.ForgeInventoryError('package-without-versions');
+    let ownerId: string | null = null;
+    let repositoryId: string | null | undefined;
+    const versions: IPackageVersion[] = [];
+    const ids = new Set<string>();
+    for (const itemArg of listing.items) {
+      const item = validation.record(itemArg);
+      const owner = validation.record(item.owner);
+      const repository = item.repository === null || item.repository === undefined ? null : validation.decimal(validation.record(item.repository).id);
+      if (segment(owner.login) !== refArg.owner || packageType(item.type) !== refArg.type || packageName(item.name) !== refArg.name) {
+        throw new validation.ForgeInventoryError('package-identity-changed');
+      }
+      // Every version names the package's owner and its one repository link.
+      if ((ownerId ?? validation.decimal(owner.id)) !== validation.decimal(owner.id) || (repositoryId !== undefined && repositoryId !== repository)) {
+        throw new validation.ForgeInventoryError('package-identity-changed');
+      }
+      ownerId = validation.decimal(owner.id);
+      repositoryId = repository;
+      const id = validation.decimal(item.id);
+      if (ids.has(id)) throw new validation.ForgeInventoryError('duplicate-id');
+      ids.add(id);
+      versions.push({ id, version: requiredString(item.version), createdAt: requiredTimestamp(item.created_at) });
+    }
+    versions.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id));
+    const blobs = new Map<string, IPackageBlob>();
+    const filesByVersion = new Map<string, Array<{ name: string; sha256: string }>>();
+    for (const version of versions) {
+      const files = (await this.#get(`${packagePath}/${encodeURIComponent(version.version)}/files`, { signal: signalArg })).body;
+      if (!Array.isArray(files)) throw new validation.ForgeInventoryError('invalid-page');
+      const read: Array<{ name: string; sha256: string }> = [];
+      for (const fileArg of files) {
+        const file = validation.record(fileArg);
+        const sha256 = requiredString(file.sha256);
+        if (!/^[0-9a-f]{64}$/.test(sha256)) throw new validation.ForgeInventoryError('invalid-sha256');
+        const size = validation.decimal(file.size);
+        const blob = blobs.get(sha256) ?? { sha256, size, files: [] };
+        if (blob.size !== size) throw new validation.ForgeInventoryError('package-blob-size-conflict');
+        const name = requiredString(file.name);
+        blob.files.push({ versionId: version.id, id: validation.decimal(file.id), name });
+        blobs.set(sha256, blob);
+        read.push({ name, sha256 });
+      }
+      filesByVersion.set(version.id, read);
+    }
+    const record: IPackageRecord = {
+      owner: refArg.owner, ownerId: ownerId!, type: refArg.type, name: refArg.name, repositoryId: repositoryId ?? null, versions,
+      blobs: [...blobs.values()].sort((aArg, bArg) => compareText(aArg.sha256, bArg.sha256)).map((blobArg) => ({
+        ...blobArg, files: blobArg.files.sort((aArg, bArg) => compareDecimal(aArg.versionId, bArg.versionId) || compareDecimal(aArg.id, bArg.id)),
+      })),
+    };
+    if (record.type === 'container') await this.#containerReferences(record, filesByVersion, signalArg);
+    if (record.type === 'npm') await this.#npmState(record, signalArg);
+    if (record.type === 'cargo') await this.#cargoYanks(record, signalArg);
+    return record;
+  }
+
+  /**
+   * Reads the references of every index candidate, a version whose file list
+   * is exactly `manifest.json` (Gitea stores an index's manifest and nothing
+   * else), by digest from the registry with the reader's Basic credentials. The
+   * bytes must hash to the listed SHA-256 and the response must be an index or
+   * a manifest list, else the unit fails with `unexpected-manifest-shape`.
+   */
+  async #containerReferences(
+    recordArg: IPackageRecord, filesArg: ReadonlyMap<string, Array<{ name: string; sha256: string }>>, signalArg?: AbortSignal,
+  ): Promise<void> {
+    if (!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/.test(recordArg.name)) {
+      throw new validation.ForgeInventoryError('invalid-image-name');
+    }
+    for (const version of recordArg.versions) {
+      const files = filesArg.get(version.id)!;
+      if (files.length !== 1 || files[0].name !== 'manifest.json') continue;
+      const digest = `sha256:${files[0].sha256}`;
+      const client = this.#basic(await this.#login(signalArg));
+      const response = await client.requestBytes(
+        new URL(`/v2/${recordArg.owner.toLowerCase()}/${recordArg.name}/manifests/${digest}`, this.#options.baseUrl),
+        { accept: containerIndexMediaTypes.join(', '), signal: signalArg },
+      );
+      if (plugins.crypto.createHash('sha256').update(response.bytes).digest('hex') !== files[0].sha256
+        || response.mediaType === null || !containerIndexMediaTypes.includes(response.mediaType)) {
+        throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      }
+      let entries: unknown;
+      try {
+        entries = validation.record(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(response.bytes)) as unknown).manifests;
+      } catch {
+        throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      }
+      if (!Array.isArray(entries)) throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      const references = entries.map((entryArg: unknown) => {
+        const entry = entryArg !== null && typeof entryArg === 'object' && !Array.isArray(entryArg) ? (entryArg as Record<string, unknown>).digest : undefined;
+        if (typeof entry !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(entry)) throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+        return entry;
+      });
+      version.references = [...new Set(references)].sort(compareText);
+    }
+  }
+
+  /** Every dist-tag Gitea serves, a `latest` it derives included, and each version's deprecation from the package document. */
+  async #npmState(recordArg: IPackageRecord, signalArg?: AbortSignal): Promise<void> {
+    const registry = `${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/npm`;
+    const name = npmPackagePath(recordArg.name);
+    const tags = validation.record((await this.#client.request(new URL(`${registry}/-/package/${name}/dist-tags`), { signal: signalArg })).body);
+    recordArg.distTags = Object.entries(tags).map(([tag, version]) => ({ tag, version: requiredString(version) }))
+      .sort((aArg, bArg) => compareText(aArg.tag, bArg.tag));
+    const versions = validation.record(validation.record((await this.#client.request(new URL(`${registry}/${name}`), { signal: signalArg })).body).versions);
+    for (const version of recordArg.versions) {
+      const entry = versions[version.version];
+      if (entry === undefined) throw new validation.ForgeInventoryError('npm-version-missing');
+      const deprecated = validation.record(entry).deprecated;
+      version.deprecated = deprecated === undefined ? '' : text(deprecated);
+    }
+  }
+
+  /** Each version's yank from the crate's line in the Cargo sparse index. */
+  async #cargoYanks(recordArg: IPackageRecord, signalArg?: AbortSignal): Promise<void> {
+    const response = await this.#client.requestBytes(
+      new URL(`${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/cargo/${cargoIndexPath(recordArg.name)}`),
+      { accept: 'text/plain', signal: signalArg },
+    );
+    if (response.mediaType !== 'text/plain') throw new validation.ForgeInventoryError('invalid-content-type');
+    const yanked = new Map<string, boolean>();
+    let lines: string[];
+    try {
+      lines = new TextDecoder('utf-8', { fatal: true }).decode(response.bytes).split('\n').filter((lineArg) => lineArg !== '');
+    } catch {
+      throw new validation.ForgeInventoryError('invalid-cargo-index');
+    }
+    for (const line of lines) {
+      let entry: Record<string, unknown>;
+      try {
+        entry = validation.record(JSON.parse(line) as unknown);
+      } catch {
+        throw new validation.ForgeInventoryError('invalid-cargo-index');
+      }
+      yanked.set(requiredString(entry.vers), requiredBoolean(entry.yanked));
+    }
+    for (const version of recordArg.versions) {
+      const value = yanked.get(version.version);
+      if (value === undefined) throw new validation.ForgeInventoryError('cargo-index-incomplete');
+      version.yanked = value;
+    }
+  }
+
   async #repository(ownerArg: string, nameArg: string, idArg: string | undefined, signalArg?: AbortSignal): Promise<IRepository> {
     const path = `/repos/${encodeURIComponent(ownerArg)}/${encodeURIComponent(nameArg)}`;
     const item = validation.record((await this.#get(path, { signal: signalArg })).body);
@@ -635,6 +984,8 @@ export class GiteaSourceInventory {
     const options = { signal: signalArg };
     const branchRules = await this.#unpaged(`${path}/branch_protections`, options);
     const tagRules = await this.#unpaged(`${path}/tag_protections`, options);
+    const collaborators = await this.#collaborators(path, signalArg);
+    const deployKeys = await this.#deployKeys(path, signalArg);
     return {
       owner: ownerArg,
       name: nameArg,
@@ -657,14 +1008,21 @@ export class GiteaSourceInventory {
       ...await this.#releases(path, signalArg),
       wikiPages: features.wiki ? await this.#count(`${path}/wiki/pages`, { ...options, missingIsEmpty: true }) : unitDisabled('wiki'),
       access: {
-        collaborators: await this.#count(`${path}/collaborators`, options),
+        collaborators: collaborators.measure,
         teams: await this.#repositoryTeams(path, options),
-        deployKeys: await this.#count(`${path}/keys`, options),
+        deployKeys: deployKeys.keys,
+        deployTokens: deployKeys.tokens,
         webhooks: await this.#count(`${path}/hooks`, options),
         branchProtections: branchRules.measure,
         tagProtections: tagRules.measure,
         pushMirrors: await this.#count(`${path}/push_mirrors`, options),
       },
+      // Never partial: an unfinished listing or permission read makes the records null.
+      accessRecords: collaborators.records === null || deployKeys.records === null ? null : {
+        collaborators: collaborators.records,
+        deployKeys: deployKeys.records.keys,
+        deployTokens: deployKeys.records.tokens,
+      },
       protections: branchRules.rows === null || tagRules.rows === null ? null : {
         branches: branchRules.rows.map(branchProtection).sort((aArg, bArg) => compareText(aArg.ruleName, bArg.ruleName)),
         tags: tagRules.rows.map(tagProtection).sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id)),
@@ -673,6 +1031,49 @@ export class GiteaSourceInventory {
     };
   }
 
+  /**
+   * The repository's collaborators, each with one read of the effective
+   * permission Gitea reports for them, never the collaboration's own mode,
+   * which no REST endpoint reports. The count is complete only when every
+   * permission was read; the first failed read ends the reads.
+   */
+  async #collaborators(pathArg: string, signalArg?: AbortSignal): Promise<{ measure: TMeasure; records: ICollaborator[] | null }> {
+    const listing = await this.#list(`${pathArg}/collaborators`, { signal: signalArg });
+    const listed = listing.items.map(account);
+    if (listing.failure !== null) return { measure: partial(listed.length, listing.failure), records: null };
+    const records: ICollaborator[] = [];
+    for (const collaborator of listed) {
+      try {
+        const read = validation.record((await this.#get(`${pathArg}/collaborators/${encodeURIComponent(collaborator.login)}/permission`, { signal: signalArg })).body);
+        if (validation.decimal(validation.record(read.user).id) !== collaborator.id) throw new validation.ForgeInventoryError('collaborator-identity-changed');
+        records.push({ userId: collaborator.id, login: collaborator.login, effectivePermission: accessMode(read.permission) });
+      } catch (error) {
+        return { measure: partial(listed.length, `collaborator-permission: ${reason(error)}`), records: null };
+      }
+    }
+    return { measure: complete(listed.length), records: records.sort((aArg, bArg) => compareDecimal(aArg.userId, bArg.userId)) };
+  }
+
+  /** SSH deploy keys and deploy tokens, which Gitea 28 lists together, counted and recorded apart. */
+  async #deployKeys(pathArg: string, signalArg?: AbortSignal): Promise<{
+    keys: TMeasure; tokens: TMeasure; records: { keys: IDeployKey[]; tokens: IDeployToken[] } | null;
+  }> {
+    const listing = await this.#list(`${pathArg}/keys`, { signal: signalArg });
+    const keys: IDeployKey[] = [];
+    const tokens: IDeployToken[] = [];
+    for (const entry of listing.items.map(deployKeyEntry)) {
+      if (entry.kind === 'ssh') keys.push(entry.key); else tokens.push(entry.token);
+    }
+    return {
+      keys: listingMeasure(listing, BigInt(keys.length)),
+      tokens: listingMeasure(listing, BigInt(tokens.length)),
+      records: listing.failure === null ? {
+        keys: keys.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id)),
+        tokens: tokens.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id)),
+      } : null,
+    };
+  }
+
   /** Gitea answers 405 for a repository that no organization owns, which therefore has no teams. */
   async #repositoryTeams(pathArg: string, optionsArg: IListOptions): Promise<TMeasure> {
     try {
@@ -693,7 +1094,7 @@ export class GiteaSourceInventory {
       baseUrl: this.#options.baseUrl, owner: ownerArg, name: nameArg, username, token: this.#options.token,
       caCertificates: this.#options.caCertificates, workDir: this.#options.gitWorkDir, reportedSizeKiB: sizeKiB,
       timeoutMs: this.#options.gitTimeoutMs,
-      lfsClient: this.#lfs(username), signal: signalArg,
+      lfsClient: this.#basic(username), signal: signalArg,
     });
     return { git: { reportedSizeKiB: complete(sizeKiB), ...measured.git }, lfs: measured.lfs, head: measured.head, refDigests: measured.refDigests };
   }
@@ -709,8 +1110,8 @@ export class GiteaSourceInventory {
     return this.#readerLogin;
   }
 
-  /** LFS routes accept the token as a Basic password, not as a `token` authorization. */
-  #lfs(usernameArg: string): ForgeRequestClient {
+  /** LFS and registry (`/v2`) routes accept the token as a Basic password, not as a `token` authorization. */
+  #basic(usernameArg: string): ForgeRequestClient {
     this.#lfsClient ??= new ForgeRequestClient({
       transport: this.#transport,
       headers: { authorization: `Basic ${Buffer.from(`${usernameArg}:${this.#options.token}`).toString('base64')}` },
@@ -949,6 +1350,9 @@ const indicator = (measureArg: TMeasure, predicateArg: (valueArg: bigint) => boo
   measureArg.status === 'complete' ? complete(predicateArg(BigInt(measureArg.value)) ? 1 : 0)
   : measureArg.status === 'partial' ? partial(predicateArg(BigInt(measureArg.observedValue)) ? 1 : 0, measureArg.reason) : measureArg;
 
+/** A repository result from a generator that predates the deploy token count, whose `deployKeys` included the tokens. */
+const deployTokensPredated = notMeasured('Measured by a generator that predates the deploy token count.');
+
 /** Every measure of a document with its dotted path. */
 const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: string; measure: TMeasure }>) => {
   if (!valueArg || typeof valueArg !== 'object') return;
@@ -972,6 +1376,10 @@ const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: st
  * repositories measured with one id, owner repository counts that disagree
  * with discovery, and every partial or unmeasured value make the inventory
  * incomplete, with reasons aggregated per subject kind, path and reason.
+ * `packages` and `totals.packageContent` (`composeGiteaPackageContent`) are
+ * present exactly when discovery lists packages, an empty list included; a
+ * package without a record is left out, never truncated, and makes its
+ * content measures partial.
  */
 export const composeGiteaSourceInventory = (
   discoveryArg: IDiscovery,
@@ -979,12 +1387,7 @@ export const composeGiteaSourceInventory = (
   generatorsArg: plugins.fossInterfaces.data.IForgeSourceInventoryGenerator[],
 ): IInventory => {
   const results = new Map<string, TUnitResult>();
-  for (const result of resultsArg) {
-    const unit: TUnit = result.kind === 'failed' ? result.unit : result.kind === 'instance' ? { kind: 'instance' }
-      : result.kind === 'owner' ? { kind: 'owner', ownerKind: result.owner.kind, name: result.owner.name }
-      : { kind: 'repository', owner: result.repository.owner, name: result.repository.name };
-    results.set(unitKey(unit), result);
-  }
+  for (const result of resultsArg) results.set(unitKey(resultUnit(result)), result);
   const reasons = new Map<string, number>();
   const addReason = (textArg: string) => reasons.set(textArg, (reasons.get(textArg) ?? 0) + 1);
   for (const text of discoveryArg.incompleteReasons) addReason(text);
@@ -1022,6 +1425,17 @@ export const composeGiteaSourceInventory = (
       addReason(`repository: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : result?.kind === 'repository' ? 'unit failed: repository-identity-changed' : 'unit not measured'}`);
     }
   }
+  // Packages only when discovery listed them; a package without a record leaves the class incomplete, never truncated.
+  let packages: IPackageRecord[] | undefined;
+  if (discoveryArg.packages !== undefined) {
+    packages = [];
+    for (const ref of discoveryArg.packages) {
+      const result = results.get(unitKey({ kind: 'package', ...ref }));
+      if (result?.kind === 'package') packages.push(result.package);
+      else addReason(`package: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : 'unit not measured'}`);
+    }
+    packages.sort(comparePackages);
+  }
   // Without discovered ids, two names measured as one id show a rename between their units.
   if (new Set(repositories.map((repositoryArg) => repositoryArg.id)).size !== repositories.length) addReason('repository: duplicate-id');
   owners.sort((aArg, bArg) => compareText(aArg.kind, bArg.kind) || compareText(aArg.name, bArg.name));
@@ -1058,6 +1472,7 @@ export const composeGiteaSourceInventory = (
     instance,
     owners,
     repositories,
+    ...(packages === undefined ? {} : { packages }),
     totals: {
       organizations: instance.organizations,
       users: instance.users.total,
@@ -1079,8 +1494,9 @@ export const composeGiteaSourceInventory = (
         ['issues', 'pullRequests', 'comments', 'reviews', 'reviewComments', 'labels', 'milestones', 'reactions', 'attachments', 'attachmentBytes'], missingRepositories),
       releases: sumGroup(repositories.map((repositoryArg) => repositoryArg.releases), ['releases', 'drafts', 'assets', 'assetBytes'], missingRepositories),
       wikiPages: sumMeasures([...repositories.map((repositoryArg) => repositoryArg.wikiPages), ...missingRepositories]),
-      access: sumGroup(repositories.map((repositoryArg) => repositoryArg.access),
-        ['collaborators', 'teams', 'deployKeys', 'webhooks', 'branchProtections', 'tagProtections', 'pushMirrors'], missingRepositories),
+      access: sumGroup(repositories.map((repositoryArg): Required<IAccessCounts> => ({
+        ...repositoryArg.access, deployTokens: repositoryArg.access.deployTokens ?? deployTokensPredated,
+      })), ['collaborators', 'teams', 'deployKeys', 'deployTokens', 'webhooks', 'branchProtections', 'tagProtections', 'pushMirrors'], missingRepositories),
       actions: sumGroup(repositories.map((repositoryArg) => repositoryArg.actions),
         ['workflows', 'secrets', 'variables', 'runners', 'runs', 'artifacts', 'artifactBytes'], missingRepositories),
       owners: {
@@ -1100,6 +1516,7 @@ export const composeGiteaSourceInventory = (
         type,
         ...sumGroup(countsArg.map(({ type: _type, ...measures }) => measures), ['packages', 'versions', 'files', 'bytes'], missingOwners),
       })),
+      ...(packages === undefined ? {} : { packageContent: composeGiteaPackageContent(discoveryArg.packages!, packages) }),
     },
   };
 
@@ -1110,7 +1527,11 @@ export const composeGiteaSourceInventory = (
     const { name: _name, id: _id, ...measures } = owner;
     measuresOf(measures, owner.kind, collected);
   }
-  for (const repository of repositories) measuresOf(repository, 'repository', collected);
+  for (const repository of repositories) {
+    measuresOf(repository, 'repository', collected);
+    // A stored result from a generator before deploy tokens counted them among its deploy keys.
+    if (repository.access.deployTokens === undefined) collected.push({ path: 'repository.access.deployTokens', measure: deployTokensPredated });
+  }
   for (const { path, measure } of collected) {
     if (measure.status !== 'complete') addReason(`${path}: ${measure.reason}`);
   }