@foss.global/codefeed 5.1.0 → 5.2.0

package/ts/classes.giteasourceinventory.ts

@@ -4,6 +4,9 @@ import * as validation from './forgeinventory.validation.js';
 import { ForgeRequestClient } from './forgeinventory.client.js';
 import type { IForgeRequestMetrics, IForgeRequestOptions } from './forgeinventory.client.js';
 import { measureGiteaMirror } from './giteasourceinventory.git.js';
+import {
+  cargoIndexPath, comparePackages, composeGiteaPackageContent, containerIndexMediaTypes, npmPackagePath, packageKey, packageTypePattern,
+} from './giteasourceinventory.packages.js';
 
 type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
 type TUnit = plugins.fossInterfaces.data.TForgeSourceInventoryUnit;
@@ -25,6 +28,10 @@ type ICollaborator = plugins.fossInterfaces.data.IForgeSourceCollaborator;
 type IDeployKey = plugins.fossInterfaces.data.IForgeSourceDeployKey;
 type IDeployToken = plugins.fossInterfaces.data.IForgeSourceDeployToken;
 type IAccessCounts = plugins.fossInterfaces.data.IForgeSourceAccessCounts;
+type IPackageRef = plugins.fossInterfaces.data.IForgeSourcePackageRef;
+type IPackageRecord = plugins.fossInterfaces.data.IForgeSourcePackageInventory;
+type IPackageVersion = plugins.fossInterfaces.data.IForgeSourcePackageVersion;
+type IPackageBlob = plugins.fossInterfaces.data.IForgeSourcePackageBlob;
 
 export interface IGiteaSourceInventoryOptions {
   /** Operator-assigned identity of the source instance. */
@@ -55,6 +62,19 @@ export interface IGiteaSourceInventoryOptions {
   maxResponseBytes?: number;
 }
 
+/** A class of source data a run measures only when its discovery selects it. */
+export type TGiteaSourceInventoryClass = 'packages';
+
+export interface IGiteaSourceDiscoveryOptions {
+  /**
+   * Classes beside the instance, owners and repositories to list for
+   * measurement. `packages` lists every package, so `units` measures one unit
+   * per package; without it, discovery carries no `packages` and the package
+   * class is unread.
+   */
+  classes?: readonly TGiteaSourceInventoryClass[];
+}
+
 export interface IGiteaSourceMeasureOptions {
   signal?: AbortSignal;
   /** Units measured at the same time. Requests within one unit are sequential. */
@@ -339,16 +359,56 @@ const countedEnvelope = (bodyArg: unknown, rowsKeyArg: string): { rows: unknown[
   return { rows, failure: validation.decimal(body.total_count) === String(rows.length) ? null : 'count-mismatch' };
 };
 
-const unitKey = (unitArg: TUnit): string => unitArg.kind === 'instance' ? 'instance'
-  : unitArg.kind === 'owner' ? `owner:${unitArg.ownerKind}:${unitArg.name}` : `repository:${unitArg.owner}/${unitArg.name}`;
+/** The unit a result answers. */
+const resultUnit = (resultArg: TUnitResult): TUnit => {
+  switch (resultArg.kind) {
+    case 'failed': return resultArg.unit;
+    case 'instance': return { kind: 'instance' };
+    case 'owner': return { kind: 'owner', ownerKind: resultArg.owner.kind, name: resultArg.owner.name };
+    case 'repository': return { kind: 'repository', owner: resultArg.repository.owner, name: resultArg.repository.name };
+    case 'package': return { kind: 'package', owner: resultArg.package.owner, type: resultArg.package.type, name: resultArg.package.name };
+    default: return unknownUnit(resultArg);
+  }
+};
+
+/** Refuses a unit kind this generator does not know, which a newer contract may add. */
+const unknownUnit = (unitArg: never): never => {
+  void unitArg;
+  throw new validation.ForgeInventoryError('unit-kind-unsupported');
+};
+
+const unitKey = (unitArg: TUnit): string => {
+  switch (unitArg.kind) {
+    case 'instance': return 'instance';
+    case 'owner': return `owner:${unitArg.ownerKind}:${unitArg.name}`;
+    case 'repository': return `repository:${unitArg.owner}/${unitArg.name}`;
+    case 'package': return `package:${packageKey(unitArg)}`;
+    default: return unknownUnit(unitArg);
+  }
+};
+
+/** A package type from a listing. */
+const packageType = (valueArg: unknown): string => {
+  const type = requiredString(valueArg);
+  if (!packageTypePattern.test(type)) throw new validation.ForgeInventoryError('invalid-package-type');
+  return type;
+};
+
+/** A package name as Gitea stores it; container and npm names may hold `/`, so it is no single path segment. */
+const packageName = (valueArg: unknown): string => {
+  const name = requiredString(valueArg);
+  if (name.length > 512 || /[\u0000-\u001f\u007f]/.test(name)) throw new validation.ForgeInventoryError('invalid-package-name');
+  return name;
+};
 
 const compareText = (aArg: string, bArg: string): number => aArg < bArg ? -1 : aArg > bArg ? 1 : 0;
 
 /**
  * Authenticated, read-only inventory of a Gitea instance, read with a site
- * administrator's token: GET requests to its REST API, a mirror clone of every
- * repository for refs, objects and LFS pointers, and LFS batch `download`
- * requests that check which referenced objects Gitea holds. It counts secrets
+ * administrator's token: GET requests to its REST API and package registries,
+ * a mirror clone of every repository for refs, objects and LFS pointers, and
+ * LFS batch `download` requests that check which referenced objects Gitea
+ * holds. It counts secrets
  * and variables without retaining their values, and reports every read that
  * did not finish as a partial or unmeasured value instead of a count.
  */
@@ -412,11 +472,15 @@ export class GiteaSourceInventory {
 
   /**
    * Identifies the source and its reader and lists every owner and repository
-   * with its id. Rejects unless the token belongs to a site administrator; a listing that
-   * does not finish, or that lists a repository id twice, is reported in
-   * `incompleteReasons`.
+   * with its id, and with `classes: ['packages']` every package from the
+   * administrator package listing (`packages`, absent otherwise). Rejects
+   * unless the token belongs to a site administrator, and rejects an unknown
+   * class with `invalid-options`; a listing that does not finish, or that
+   * lists a repository id twice, is reported in `incompleteReasons`.
    */
-  public async discover(signalArg?: AbortSignal): Promise<IDiscovery> {
+  public async discover(signalArg?: AbortSignal, optionsArg: IGiteaSourceDiscoveryOptions = {}): Promise<IDiscovery> {
+    const classes = optionsArg.classes ?? [];
+    if (!Array.isArray(classes) || classes.some((classArg) => classArg !== 'packages')) throw new validation.ForgeInventoryError('invalid-options');
     const reader = validation.record((await this.#get('/user', { signal: signalArg })).body);
     if (reader.is_admin !== true) throw new validation.ForgeInventoryError('reader-not-site-admin');
     const version = validation.record((await this.#get('/version', { signal: signalArg })).body).version;
@@ -453,16 +517,34 @@ export class GiteaSourceInventory {
     }
     if (ids.size !== repositories.items.length) incompleteReasons.push('discovery: repositories: duplicate-id');
     discovered.sort((aArg, bArg) => compareText(aArg.owner, bArg.owner) || compareText(aArg.name, bArg.name));
+    let packages: IPackageRef[] | undefined;
+    if (classes.includes('packages')) {
+      // One row per package version, of every owner, user-owned packages included.
+      const versions = await this.#list('/admin/packages', { signal: signalArg });
+      if (versions.failure !== null) incompleteReasons.push(`discovery: packages: ${versions.failure}`);
+      const refs = new Map<string, IPackageRef>();
+      for (const itemArg of versions.items) {
+        const item = validation.record(itemArg);
+        const ref = { owner: segment(validation.record(item.owner).login), type: packageType(item.type), name: packageName(item.name) };
+        refs.set(packageKey(ref), ref);
+      }
+      packages = [...refs.values()].sort(comparePackages);
+    }
     return {
       source: { instanceId: this.#options.instanceId, kind: 'gitea', baseUrl: this.#options.baseUrl, version },
       reader: { login: segment(reader.login), siteAdmin: true },
       owners,
       repositories: discovered,
+      ...(packages === undefined ? {} : { packages }),
       incompleteReasons: incompleteReasons.sort(compareText),
     };
   }
 
-  /** Every unit a run over this discovery measures: the instance, then owners, then repositories. */
+  /**
+   * Every unit a run over this discovery measures: the instance, then owners,
+   * then repositories, then the packages discovery lists when it selected
+   * them.
+   */
   public units(discoveryArg: IDiscovery): TUnit[] {
     return [
       { kind: 'instance' },
@@ -470,6 +552,7 @@ export class GiteaSourceInventory {
       ...discoveryArg.repositories.map((repositoryArg): TUnit => ({
         kind: 'repository', owner: repositoryArg.owner, name: repositoryArg.name, ...repositoryArg.id === undefined ? {} : { id: repositoryArg.id },
       })),
+      ...(discoveryArg.packages ?? []).map((packageArg): TUnit => ({ kind: 'package', owner: packageArg.owner, type: packageArg.type, name: packageArg.name })),
     ];
   }
 
@@ -497,15 +580,31 @@ export class GiteaSourceInventory {
   /**
    * Measures one unit. Never rejects: a unit whose primary record cannot be
    * read is `failed`, and so is a repository unit carrying an id that its name
-   * no longer answers with (`repository-identity-changed`).
+   * no longer answers with (`repository-identity-changed`). A package unit is
+   * read whole or fails, never partly: a listing that does not finish, an
+   * index that is not what its file list promises (`unexpected-manifest-shape`)
+   * and a result over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON
+   * (`unit-over-bound`) fail it, and its record is never truncated.
    */
   public async measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult> {
     try {
-      if (unitArg.kind === 'instance') return { kind: 'instance', instance: await this.#instance(signalArg) };
-      if (unitArg.kind === 'owner') {
-        return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
+      switch (unitArg.kind) {
+        case 'instance':
+          return { kind: 'instance', instance: await this.#instance(signalArg) };
+        case 'owner':
+          return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
+        case 'repository':
+          return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, unitArg.id, signalArg) };
+        case 'package': {
+          const result: TUnitResult = { kind: 'package', package: await this.#package(unitArg, signalArg) };
+          if (Buffer.byteLength(JSON.stringify(result), 'utf8') > plugins.fossInterfaces.data.forgeSourceInventoryUnitMaxBytes) {
+            return { kind: 'failed', unit: unitArg, reason: 'unit-over-bound' };
+          }
+          return result;
+        }
+        default:
+          return unknownUnit(unitArg);
       }
-      return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, unitArg.id, signalArg) };
     } catch (error) {
       return { kind: 'failed', unit: unitArg, reason: reason(error) };
     }
@@ -700,6 +799,164 @@ export class GiteaSourceInventory {
     return counts;
   }
 
+  /**
+   * One package as Gitea's v1 package API lists it: every version with its
+   * files, each distinct content once. Container index candidates, versions
+   * whose only file is `manifest.json`, are read by digest for their
+   * references; no other manifest is read. npm packages add the dist-tags Gitea
+   * serves (a derived `latest` included) and each version's deprecation,
+   * Cargo crates each version's yank from the sparse index. Every read is a
+   * GET; reading an index counts a download of its version, an accepted read
+   * stamp (S10 ruling, Addendum 1).
+   */
+  async #package(refArg: IPackageRef, signalArg?: AbortSignal): Promise<IPackageRecord> {
+    const packagePath = `/packages/${encodeURIComponent(refArg.owner)}/${encodeURIComponent(refArg.type)}/${encodeURIComponent(refArg.name)}`;
+    const listing = await this.#list(packagePath, { signal: signalArg });
+    if (listing.failure !== null) throw new validation.ForgeInventoryError(listing.failure);
+    if (listing.items.length === 0) throw new validation.ForgeInventoryError('package-without-versions');
+    let ownerId: string | null = null;
+    let repositoryId: string | null | undefined;
+    const versions: IPackageVersion[] = [];
+    const ids = new Set<string>();
+    for (const itemArg of listing.items) {
+      const item = validation.record(itemArg);
+      const owner = validation.record(item.owner);
+      const repository = item.repository === null || item.repository === undefined ? null : validation.decimal(validation.record(item.repository).id);
+      if (segment(owner.login) !== refArg.owner || packageType(item.type) !== refArg.type || packageName(item.name) !== refArg.name) {
+        throw new validation.ForgeInventoryError('package-identity-changed');
+      }
+      // Every version names the package's owner and its one repository link.
+      if ((ownerId ?? validation.decimal(owner.id)) !== validation.decimal(owner.id) || (repositoryId !== undefined && repositoryId !== repository)) {
+        throw new validation.ForgeInventoryError('package-identity-changed');
+      }
+      ownerId = validation.decimal(owner.id);
+      repositoryId = repository;
+      const id = validation.decimal(item.id);
+      if (ids.has(id)) throw new validation.ForgeInventoryError('duplicate-id');
+      ids.add(id);
+      versions.push({ id, version: requiredString(item.version), createdAt: requiredTimestamp(item.created_at) });
+    }
+    versions.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id));
+    const blobs = new Map<string, IPackageBlob>();
+    const filesByVersion = new Map<string, Array<{ name: string; sha256: string }>>();
+    for (const version of versions) {
+      const files = (await this.#get(`${packagePath}/${encodeURIComponent(version.version)}/files`, { signal: signalArg })).body;
+      if (!Array.isArray(files)) throw new validation.ForgeInventoryError('invalid-page');
+      const read: Array<{ name: string; sha256: string }> = [];
+      for (const fileArg of files) {
+        const file = validation.record(fileArg);
+        const sha256 = requiredString(file.sha256);
+        if (!/^[0-9a-f]{64}$/.test(sha256)) throw new validation.ForgeInventoryError('invalid-sha256');
+        const size = validation.decimal(file.size);
+        const blob = blobs.get(sha256) ?? { sha256, size, files: [] };
+        if (blob.size !== size) throw new validation.ForgeInventoryError('package-blob-size-conflict');
+        const name = requiredString(file.name);
+        blob.files.push({ versionId: version.id, id: validation.decimal(file.id), name });
+        blobs.set(sha256, blob);
+        read.push({ name, sha256 });
+      }
+      filesByVersion.set(version.id, read);
+    }
+    const record: IPackageRecord = {
+      owner: refArg.owner, ownerId: ownerId!, type: refArg.type, name: refArg.name, repositoryId: repositoryId ?? null, versions,
+      blobs: [...blobs.values()].sort((aArg, bArg) => compareText(aArg.sha256, bArg.sha256)).map((blobArg) => ({
+        ...blobArg, files: blobArg.files.sort((aArg, bArg) => compareDecimal(aArg.versionId, bArg.versionId) || compareDecimal(aArg.id, bArg.id)),
+      })),
+    };
+    if (record.type === 'container') await this.#containerReferences(record, filesByVersion, signalArg);
+    if (record.type === 'npm') await this.#npmState(record, signalArg);
+    if (record.type === 'cargo') await this.#cargoYanks(record, signalArg);
+    return record;
+  }
+
+  /**
+   * Reads the references of every index candidate, a version whose file list
+   * is exactly `manifest.json` (Gitea stores an index's manifest and nothing
+   * else), by digest from the registry with the reader's Basic credentials. The
+   * bytes must hash to the listed SHA-256 and the response must be an index or
+   * a manifest list, else the unit fails with `unexpected-manifest-shape`.
+   */
+  async #containerReferences(
+    recordArg: IPackageRecord, filesArg: ReadonlyMap<string, Array<{ name: string; sha256: string }>>, signalArg?: AbortSignal,
+  ): Promise<void> {
+    if (!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/.test(recordArg.name)) {
+      throw new validation.ForgeInventoryError('invalid-image-name');
+    }
+    for (const version of recordArg.versions) {
+      const files = filesArg.get(version.id)!;
+      if (files.length !== 1 || files[0].name !== 'manifest.json') continue;
+      const digest = `sha256:${files[0].sha256}`;
+      const client = this.#basic(await this.#login(signalArg));
+      const response = await client.requestBytes(
+        new URL(`/v2/${recordArg.owner.toLowerCase()}/${recordArg.name}/manifests/${digest}`, this.#options.baseUrl),
+        { accept: containerIndexMediaTypes.join(', '), signal: signalArg },
+      );
+      if (plugins.crypto.createHash('sha256').update(response.bytes).digest('hex') !== files[0].sha256
+        || response.mediaType === null || !containerIndexMediaTypes.includes(response.mediaType)) {
+        throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      }
+      let entries: unknown;
+      try {
+        entries = validation.record(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(response.bytes)) as unknown).manifests;
+      } catch {
+        throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      }
+      if (!Array.isArray(entries)) throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+      const references = entries.map((entryArg: unknown) => {
+        const entry = entryArg !== null && typeof entryArg === 'object' && !Array.isArray(entryArg) ? (entryArg as Record<string, unknown>).digest : undefined;
+        if (typeof entry !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(entry)) throw new validation.ForgeInventoryError('unexpected-manifest-shape');
+        return entry;
+      });
+      version.references = [...new Set(references)].sort(compareText);
+    }
+  }
+
+  /** Every dist-tag Gitea serves, a `latest` it derives included, and each version's deprecation from the package document. */
+  async #npmState(recordArg: IPackageRecord, signalArg?: AbortSignal): Promise<void> {
+    const registry = `${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/npm`;
+    const name = npmPackagePath(recordArg.name);
+    const tags = validation.record((await this.#client.request(new URL(`${registry}/-/package/${name}/dist-tags`), { signal: signalArg })).body);
+    recordArg.distTags = Object.entries(tags).map(([tag, version]) => ({ tag, version: requiredString(version) }))
+      .sort((aArg, bArg) => compareText(aArg.tag, bArg.tag));
+    const versions = validation.record(validation.record((await this.#client.request(new URL(`${registry}/${name}`), { signal: signalArg })).body).versions);
+    for (const version of recordArg.versions) {
+      const entry = versions[version.version];
+      if (entry === undefined) throw new validation.ForgeInventoryError('npm-version-missing');
+      const deprecated = validation.record(entry).deprecated;
+      version.deprecated = deprecated === undefined ? '' : text(deprecated);
+    }
+  }
+
+  /** Each version's yank from the crate's line in the Cargo sparse index. */
+  async #cargoYanks(recordArg: IPackageRecord, signalArg?: AbortSignal): Promise<void> {
+    const response = await this.#client.requestBytes(
+      new URL(`${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/cargo/${cargoIndexPath(recordArg.name)}`),
+      { accept: 'text/plain', signal: signalArg },
+    );
+    if (response.mediaType !== 'text/plain') throw new validation.ForgeInventoryError('invalid-content-type');
+    const yanked = new Map<string, boolean>();
+    let lines: string[];
+    try {
+      lines = new TextDecoder('utf-8', { fatal: true }).decode(response.bytes).split('\n').filter((lineArg) => lineArg !== '');
+    } catch {
+      throw new validation.ForgeInventoryError('invalid-cargo-index');
+    }
+    for (const line of lines) {
+      let entry: Record<string, unknown>;
+      try {
+        entry = validation.record(JSON.parse(line) as unknown);
+      } catch {
+        throw new validation.ForgeInventoryError('invalid-cargo-index');
+      }
+      yanked.set(requiredString(entry.vers), requiredBoolean(entry.yanked));
+    }
+    for (const version of recordArg.versions) {
+      const value = yanked.get(version.version);
+      if (value === undefined) throw new validation.ForgeInventoryError('cargo-index-incomplete');
+      version.yanked = value;
+    }
+  }
+
   async #repository(ownerArg: string, nameArg: string, idArg: string | undefined, signalArg?: AbortSignal): Promise<IRepository> {
     const path = `/repos/${encodeURIComponent(ownerArg)}/${encodeURIComponent(nameArg)}`;
     const item = validation.record((await this.#get(path, { signal: signalArg })).body);
@@ -837,7 +1094,7 @@ export class GiteaSourceInventory {
       baseUrl: this.#options.baseUrl, owner: ownerArg, name: nameArg, username, token: this.#options.token,
       caCertificates: this.#options.caCertificates, workDir: this.#options.gitWorkDir, reportedSizeKiB: sizeKiB,
       timeoutMs: this.#options.gitTimeoutMs,
-      lfsClient: this.#lfs(username), signal: signalArg,
+      lfsClient: this.#basic(username), signal: signalArg,
     });
     return { git: { reportedSizeKiB: complete(sizeKiB), ...measured.git }, lfs: measured.lfs, head: measured.head, refDigests: measured.refDigests };
   }
@@ -853,8 +1110,8 @@ export class GiteaSourceInventory {
     return this.#readerLogin;
   }
 
-  /** LFS routes accept the token as a Basic password, not as a `token` authorization. */
-  #lfs(usernameArg: string): ForgeRequestClient {
+  /** LFS and registry (`/v2`) routes accept the token as a Basic password, not as a `token` authorization. */
+  #basic(usernameArg: string): ForgeRequestClient {
     this.#lfsClient ??= new ForgeRequestClient({
       transport: this.#transport,
       headers: { authorization: `Basic ${Buffer.from(`${usernameArg}:${this.#options.token}`).toString('base64')}` },
@@ -1119,6 +1376,10 @@ const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: st
  * repositories measured with one id, owner repository counts that disagree
  * with discovery, and every partial or unmeasured value make the inventory
  * incomplete, with reasons aggregated per subject kind, path and reason.
+ * `packages` and `totals.packageContent` (`composeGiteaPackageContent`) are
+ * present exactly when discovery lists packages, an empty list included; a
+ * package without a record is left out, never truncated, and makes its
+ * content measures partial.
  */
 export const composeGiteaSourceInventory = (
   discoveryArg: IDiscovery,
@@ -1126,12 +1387,7 @@ export const composeGiteaSourceInventory = (
   generatorsArg: plugins.fossInterfaces.data.IForgeSourceInventoryGenerator[],
 ): IInventory => {
   const results = new Map<string, TUnitResult>();
-  for (const result of resultsArg) {
-    const unit: TUnit = result.kind === 'failed' ? result.unit : result.kind === 'instance' ? { kind: 'instance' }
-      : result.kind === 'owner' ? { kind: 'owner', ownerKind: result.owner.kind, name: result.owner.name }
-      : { kind: 'repository', owner: result.repository.owner, name: result.repository.name };
-    results.set(unitKey(unit), result);
-  }
+  for (const result of resultsArg) results.set(unitKey(resultUnit(result)), result);
   const reasons = new Map<string, number>();
   const addReason = (textArg: string) => reasons.set(textArg, (reasons.get(textArg) ?? 0) + 1);
   for (const text of discoveryArg.incompleteReasons) addReason(text);
@@ -1169,6 +1425,17 @@ export const composeGiteaSourceInventory = (
       addReason(`repository: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : result?.kind === 'repository' ? 'unit failed: repository-identity-changed' : 'unit not measured'}`);
     }
   }
+  // Packages only when discovery listed them; a package without a record leaves the class incomplete, never truncated.
+  let packages: IPackageRecord[] | undefined;
+  if (discoveryArg.packages !== undefined) {
+    packages = [];
+    for (const ref of discoveryArg.packages) {
+      const result = results.get(unitKey({ kind: 'package', ...ref }));
+      if (result?.kind === 'package') packages.push(result.package);
+      else addReason(`package: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : 'unit not measured'}`);
+    }
+    packages.sort(comparePackages);
+  }
   // Without discovered ids, two names measured as one id show a rename between their units.
   if (new Set(repositories.map((repositoryArg) => repositoryArg.id)).size !== repositories.length) addReason('repository: duplicate-id');
   owners.sort((aArg, bArg) => compareText(aArg.kind, bArg.kind) || compareText(aArg.name, bArg.name));
@@ -1205,6 +1472,7 @@ export const composeGiteaSourceInventory = (
     instance,
     owners,
     repositories,
+    ...(packages === undefined ? {} : { packages }),
     totals: {
       organizations: instance.organizations,
       users: instance.users.total,
@@ -1248,6 +1516,7 @@ export const composeGiteaSourceInventory = (
         type,
         ...sumGroup(countsArg.map(({ type: _type, ...measures }) => measures), ['packages', 'versions', 'files', 'bytes'], missingOwners),
       })),
+      ...(packages === undefined ? {} : { packageContent: composeGiteaPackageContent(discoveryArg.packages!, packages) }),
     },
   };