@foss.global/codefeed 5.2.0 → 5.4.0

package/changelog.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 2026-11-13 - 5.4.0
+
+### Fixes
+
+- accept every Swift version Gitea can key an alternate manifest by (giteasourcetransfer)
+  - `readPackageDocument(…, 'swift-manifest', { swiftVersion })` refused a segment of more than 18 digits with `swift-version-invalid`, although Gitea 28.2.0 parses a manifest's version with go-version, whose segments are 64-bit signed integers, and holds every key it parses. A segment is now accepted up to 9223372036854775807, compared by value; a larger one is still refused, as are leading zeros, a zero patch, and anything but two or three segments.
+  - Compatibility: every version 5.3.0 accepted is still accepted; only keys with 19-digit segments up to that maximum are newly read.
+
+### Features
+
+- record each Swift version's manifests (giteasourceinventory)
+  - A Swift package unit now carries `manifests` on every version (`IForgeSourceSwiftManifest`s: `key`, `size`, `sha256`, sorted by key in code-unit order), exactly the manifests Gitea answers 200 for, `''` (`Package.swift`) always among them (S10 C5 ruling, Addenda 2 and 3).
+  - The inventory reads each version's source archive once, verified against its recorded size and SHA-256, takes the candidate keys from the archive's central directory (zip64 included) as Gitea 28.2.0 derives manifests: every entry, in any directory, whose base name matches `manifestPattern` and whose version `NewSemver` parses, trimmed like `TrimmedVersionString`. It asks Gitea's manifest route for each key; the 303 to the release's `Package.swift` means Gitea does not hold it. More than 64 distinct keys fail the unit with `swift-manifest-candidates-over-bound`; a Swift version with other than one file with `swift-version-files-unexpected`; an archive that is no zip archive with `swift-archive-invalid`; a failed archive read with its `package-content-*` or `http-<status>` code.
+  - New options: `maxSwiftArchiveBytes` (default 128 MiB, at most 1 GiB) bounds the archives read; a version whose recorded archive is larger records `manifests: null` and is not requested, and an archive of exactly the bound is read. `packageTransferTimeoutMs` (default 30 minutes, at most six hours) limits one archive download; `requestTimeoutMs` is its idle limit.
+  - `metrics` counts the archive GETs, their response bytes and 429 answers.
+  - Compatibility: each Swift version's archive GET counts one download of the version, the accepted read stamp (S10 ruling item 8); the inventory issues no other new request but the manifest route, which counts nothing. Results of non-Swift packages are unchanged.
+  - Dependencies: `@foss.global/interfaces` ^3.3.0, which defines `manifests`, and, for the Docker Gitea test, `@foss.global/forgefixtures` ^1.1.0, whose default seed records the manifests Gitea serves and adds a Swift release with a root and a nested alternate manifest.
+
+### Maintenance
+
+- The source transfer's verified package content download moves into the internal transfer module as `verifiedPackageDownload`, to be shared with the source inventory; its behaviour, limits and error codes are unchanged (forgeinventory)
+
+## 2026-11-11 - 5.3.0
+
+### Fixes
+
+- return package metadata documents in a canonical form instead of the bytes Gitea served (giteasourcetransfer)
+  - Gitea 28 writes a JSON object held in a map in a new key order on every read: one unchanged crate version's sparse index line came back in 6 byte sequences over 40 reads (its `features`), and npm version documents hold maps too. The SHA-256 5.2.0 returned beside `npm-version`, `swift-release` and `cargo-index-entry` documents therefore changed from read to read, and it covered state the inventory records apart (a Cargo `yanked`, an npm `deprecated`), so a recorded digest could never match a later one (S10b ruling 2026-11-11, D1 and D2).
+  - `readPackageDocument` now returns those documents as `canonicalPackageDocument` writes them, with the SHA-256 of the canonical bytes; the served bytes are not returned. `swift-manifest` stays verbatim.
+  - Upgrade: no consumer of 5.2.0's `readPackageDocument` exists; a digest recorded from it must be read again.
+
+### Features
+
+- export `canonicalPackageDocument(kind, bytes)`, the canonical form and SHA-256 of a JSON package document, for consumers to compare their own documents with what they read (giteasourcetransfer)
+  - Decode as UTF-8 (fatal) and parse a JSON object; remove the top-level `yanked` of a Cargo index entry or `deprecated` of an npm version document; write it compact with object keys sorted by code point at every depth, arrays in order and strings and integers as `JSON.stringify` writes them. A number that is not a safe integer, or a document that is not a JSON object, rejects with `document-not-canonical`.
+- read a Swift release's alternate manifests (giteasourcetransfer)
+  - `readPackageDocument(package, version, 'swift-manifest', { swiftVersion })` reads `Package@swift-<v>.swift` through `?swift-version=` without following a redirect and resolves `null` only on Gitea's 303 to the release's own `Package.swift`, its answer for a version it holds no manifest for. Another redirect rejects with `swift-manifest-redirect-unexpected`, another status with `http-<status>`, a version Gitea would not key a manifest by with `swift-version-invalid` before any request. `Package.swift` itself must still answer 200.
+- read a crate's description (giteasourcetransfer)
+  - The new kind `cargo-description` returns `{"description":…}` from the crate's entry in the Cargo search (`q=<name>`, the exact name, paged, at most 200 pages of 50, then `cargo-search-over-bound`). Gitea describes only the version with the highest id there, so `max_version` must be the requested version, else `package-document-missing`.
+- `ForgeRequestClient.requestBytesOrRedirect` returns a redirect (status and `Location`) instead of refusing it, never following it; the transports take `redirect: 'return'` for it (forgeinventory)
+
+### Tests
+
+- Check against @foss.global/forgefixtures ^1.0.0 on Gitea 28.2.0 that every JSON document read is canonical and recomputes to its digest, that an archive with an alternate and a nested manifest serves the alternate one and redirects for the nested one, that the crate description belongs to the latest version only, and, with the fixture's state snapshots, that the alternate manifest, redirect and search reads change nothing but the administrator token's `access_token.updated_unix`, no download count included (giteasourceinventory, giteasourcetransfer)
+- Check the canonical form (code-point key order at every depth, arrays in order, the kind's state member only, unsafe numbers, invalid UTF-8 and non-objects), the search paging, exact name, latest-version rule and bound, and the manifest redirect rules (relative and absolute `Location`, another release, another status, the default manifest) against a local HTTPS server, and the fetch transport's redirect modes (giteasourcetransfer, forgeinventory)
+
 ## 2026-11-11 - 5.2.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/codefeed',
-    version: '5.2.0',
+    version: '5.4.0',
     description: 'The @foss.global/codefeed module generates commit/activity feeds from forge providers including Gitea and GitManager.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx1QkFBdUI7SUFDN0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHVIQUF1SDtDQUNySSxDQUFBIn0=

package/dist_ts/classes.giteasourceinventory.d.ts

@@ -29,8 +29,18 @@ export interface IGiteaSourceInventoryOptions {
     pageSize?: number;
     /** Pages read per listing before the listing counts as partial. */
     maxPages?: number;
+    /** Deadline of one REST, registry or LFS batch request, and the idle limit of a Swift archive download; defaults to 60 s, at most 300 s. */
     requestTimeoutMs?: number;
     maxResponseBytes?: number;
+    /**
+     * The largest Swift source archive, in bytes, that the inventory reads for
+     * the version's `manifests`; defaults to 128 MiB, at most 1 GiB. A version
+     * whose recorded archive is larger is not read and records `manifests:
+     * null`. A consumer passes the cap its own store puts on an archive.
+     */
+    maxSwiftArchiveBytes?: number;
+    /** Wall-clock limit of one Swift archive download; defaults to 30 minutes, at most six hours. */
+    packageTransferTimeoutMs?: number;
 }
 /** A class of source data a run measures only when its discovery selects it. */
 export type TGiteaSourceInventoryClass = 'packages';
@@ -76,7 +86,7 @@ export declare class GiteaSourceInventory {
     constructor(optionsArg: IGiteaSourceInventoryOptions);
     /** Validated, normalized instance root; contains no credentials or API suffix. */
     get baseUrl(): string;
-    /** REST and LFS batch requests together. */
+    /** REST, registry and LFS batch requests and Swift archive GETs together. */
     get metrics(): IForgeRequestMetrics;
     /**
      * Identifies the source and its reader and lists every owner and repository