@foss.global/codefeed 5.3.0 → 5.4.0

package/changelog.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2026-11-13 - 5.4.0
+
+### Fixes
+
+- accept every Swift version Gitea can key an alternate manifest by (giteasourcetransfer)
+  - `readPackageDocument(…, 'swift-manifest', { swiftVersion })` refused a segment of more than 18 digits with `swift-version-invalid`, although Gitea 28.2.0 parses a manifest's version with go-version, whose segments are 64-bit signed integers, and holds every key it parses. A segment is now accepted up to 9223372036854775807, compared by value; a larger one is still refused, as are leading zeros, a zero patch, and anything but two or three segments.
+  - Compatibility: every version 5.3.0 accepted is still accepted; only keys with 19-digit segments up to that maximum are newly read.
+
+### Features
+
+- record each Swift version's manifests (giteasourceinventory)
+  - A Swift package unit now carries `manifests` on every version (`IForgeSourceSwiftManifest`s: `key`, `size`, `sha256`, sorted by key in code-unit order), exactly the manifests Gitea answers 200 for, `''` (`Package.swift`) always among them (S10 C5 ruling, Addenda 2 and 3).
+  - The inventory reads each version's source archive once, verified against its recorded size and SHA-256, takes the candidate keys from the archive's central directory (zip64 included) as Gitea 28.2.0 derives manifests: every entry, in any directory, whose base name matches `manifestPattern` and whose version `NewSemver` parses, trimmed like `TrimmedVersionString`. It asks Gitea's manifest route for each key; the 303 to the release's `Package.swift` means Gitea does not hold it. More than 64 distinct keys fail the unit with `swift-manifest-candidates-over-bound`; a Swift version with other than one file with `swift-version-files-unexpected`; an archive that is no zip archive with `swift-archive-invalid`; a failed archive read with its `package-content-*` or `http-<status>` code.
+  - New options: `maxSwiftArchiveBytes` (default 128 MiB, at most 1 GiB) bounds the archives read; a version whose recorded archive is larger records `manifests: null` and is not requested, and an archive of exactly the bound is read. `packageTransferTimeoutMs` (default 30 minutes, at most six hours) limits one archive download; `requestTimeoutMs` is its idle limit.
+  - `metrics` counts the archive GETs, their response bytes and 429 answers.
+  - Compatibility: each Swift version's archive GET counts one download of the version, the accepted read stamp (S10 ruling item 8); the inventory issues no other new request but the manifest route, which counts nothing. Results of non-Swift packages are unchanged.
+  - Dependencies: `@foss.global/interfaces` ^3.3.0, which defines `manifests`, and, for the Docker Gitea test, `@foss.global/forgefixtures` ^1.1.0, whose default seed records the manifests Gitea serves and adds a Swift release with a root and a nested alternate manifest.
+
+### Maintenance
+
+- The source transfer's verified package content download moves into the internal transfer module as `verifiedPackageDownload`, to be shared with the source inventory; its behaviour, limits and error codes are unchanged (forgeinventory)
+
 ## 2026-11-11 - 5.3.0
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/codefeed',
-    version: '5.3.0',
+    version: '5.4.0',
     description: 'The @foss.global/codefeed module generates commit/activity feeds from forge providers including Gitea and GitManager.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx1QkFBdUI7SUFDN0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHVIQUF1SDtDQUNySSxDQUFBIn0=

package/dist_ts/classes.giteasourceinventory.d.ts

@@ -29,8 +29,18 @@ export interface IGiteaSourceInventoryOptions {
     pageSize?: number;
     /** Pages read per listing before the listing counts as partial. */
     maxPages?: number;
+    /** Deadline of one REST, registry or LFS batch request, and the idle limit of a Swift archive download; defaults to 60 s, at most 300 s. */
     requestTimeoutMs?: number;
     maxResponseBytes?: number;
+    /**
+     * The largest Swift source archive, in bytes, that the inventory reads for
+     * the version's `manifests`; defaults to 128 MiB, at most 1 GiB. A version
+     * whose recorded archive is larger is not read and records `manifests:
+     * null`. A consumer passes the cap its own store puts on an archive.
+     */
+    maxSwiftArchiveBytes?: number;
+    /** Wall-clock limit of one Swift archive download; defaults to 30 minutes, at most six hours. */
+    packageTransferTimeoutMs?: number;
 }
 /** A class of source data a run measures only when its discovery selects it. */
 export type TGiteaSourceInventoryClass = 'packages';
@@ -76,7 +86,7 @@ export declare class GiteaSourceInventory {
     constructor(optionsArg: IGiteaSourceInventoryOptions);
     /** Validated, normalized instance root; contains no credentials or API suffix. */
     get baseUrl(): string;
-    /** REST and LFS batch requests together. */
+    /** REST, registry and LFS batch requests and Swift archive GETs together. */
     get metrics(): IForgeRequestMetrics;
     /**
      * Identifies the source and its reader and lists every owner and repository