@foss.global/codefeed 5.3.0 → 5.5.0

package/ts/classes.giteasourceinventory.ts

@@ -3,9 +3,11 @@ import * as transport from './forgeinventory.transport.js';
 import * as validation from './forgeinventory.validation.js';
 import { ForgeRequestClient } from './forgeinventory.client.js';
 import type { IForgeRequestMetrics, IForgeRequestOptions } from './forgeinventory.client.js';
+import { verifiedPackageDownload } from './forgeinventory.transfer.js';
 import { measureGiteaMirror } from './giteasourceinventory.git.js';
 import {
   cargoIndexPath, comparePackages, composeGiteaPackageContent, containerIndexMediaTypes, npmPackagePath, packageKey, packageTypePattern,
+  readSwiftManifest, swiftManifestCandidates, swiftPackageParts,
 } from './giteasourceinventory.packages.js';
 
 type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
@@ -32,6 +34,17 @@ type IPackageRef = plugins.fossInterfaces.data.IForgeSourcePackageRef;
 type IPackageRecord = plugins.fossInterfaces.data.IForgeSourcePackageInventory;
 type IPackageVersion = plugins.fossInterfaces.data.IForgeSourcePackageVersion;
 type IPackageBlob = plugins.fossInterfaces.data.IForgeSourcePackageBlob;
+type ISwiftManifest = plugins.fossInterfaces.data.IForgeSourceSwiftManifest;
+type ICollaborationCounts = plugins.fossInterfaces.data.IForgeSourceCollaborationCounts;
+type ICollaborationKindCounts = plugins.fossInterfaces.data.IForgeSourceCollaborationKindCounts;
+type ICollaboration = plugins.fossInterfaces.data.IForgeSourceCollaborationInventory;
+type IIssue = plugins.fossInterfaces.data.IForgeSourceIssue;
+type IIssueComment = plugins.fossInterfaces.data.IForgeSourceIssueComment;
+type ILabel = plugins.fossInterfaces.data.IForgeSourceLabel;
+type IMilestone = plugins.fossInterfaces.data.IForgeSourceMilestone;
+type IAccountRef = plugins.fossInterfaces.data.IForgeSourceAccountRef;
+type IOriginalAuthor = plugins.fossInterfaces.data.IForgeSourceOriginalAuthor;
+type TCollaborationState = plugins.fossInterfaces.data.TForgeSourceCollaborationState;
 
 export interface IGiteaSourceInventoryOptions {
   /** Operator-assigned identity of the source instance. */
@@ -58,19 +71,32 @@ export interface IGiteaSourceInventoryOptions {
   pageSize?: number;
   /** Pages read per listing before the listing counts as partial. */
   maxPages?: number;
+  /** Deadline of one REST, registry or LFS batch request, and the idle limit of a Swift archive download; defaults to 60 s, at most 300 s. */
   requestTimeoutMs?: number;
   maxResponseBytes?: number;
+  /**
+   * The largest Swift source archive, in bytes, that the inventory reads for
+   * the version's `manifests`; defaults to 128 MiB, at most 1 GiB. A version
+   * whose recorded archive is larger is not read and records `manifests:
+   * null`. A consumer passes the cap its own store puts on an archive.
+   */
+  maxSwiftArchiveBytes?: number;
+  /** Wall-clock limit of one Swift archive download; defaults to 30 minutes, at most six hours. */
+  packageTransferTimeoutMs?: number;
 }
 
 /** A class of source data a run measures only when its discovery selects it. */
-export type TGiteaSourceInventoryClass = 'packages';
+export type TGiteaSourceInventoryClass = 'packages' | 'collaboration';
 
 export interface IGiteaSourceDiscoveryOptions {
   /**
    * Classes beside the instance, owners and repositories to list for
    * measurement. `packages` lists every package, so `units` measures one unit
    * per package; without it, discovery carries no `packages` and the package
-   * class is unread.
+   * class is unread. `collaboration` sets discovery's `collaboration: true`,
+   * so `units` measures one collaboration unit per repository, and the
+   * composed inventory carries the records and every organization's
+   * `labelRecords`; without it, collaboration records are unread.
    */
   classes?: readonly TGiteaSourceInventoryClass[];
 }
@@ -88,6 +114,9 @@ export type TGiteaSourceRepositoryLookup =
   | { status: 'present'; id: string; owner: string; name: string }
   | { status: 'absent'; id: string };
 
+/** A file of a version as its listing reports it: the name, and the content's SHA-256 and size as a canonical decimal. */
+interface IVersionFile { name: string; sha256: string; size: string }
+
 interface IListing {
   items: unknown[];
   /** A sanitized reason when the listing did not finish. */
@@ -115,7 +144,15 @@ export const giteaSourceInventoryLimitations: readonly string[] = [
 const complete = (valueArg: bigint | number): TMeasure => ({ status: 'complete', value: BigInt(valueArg).toString() });
 const partial = (observedArg: bigint | number, reasonArg: string): TMeasure => ({ status: 'partial', observedValue: BigInt(observedArg).toString(), reason: reasonArg });
 const notMeasured = (reasonArg: string): TMeasure => ({ status: 'notMeasured', reason: reasonArg });
-const unitDisabled = (unitArg: string): TMeasure => notMeasured(`The ${unitArg} unit is disabled; Gitea's API hides its data.`);
+const unitDisabledReason = (unitArg: string): string => `The ${unitArg} unit is disabled; Gitea's API hides its data.`;
+const unitDisabled = (unitArg: string): TMeasure => notMeasured(unitDisabledReason(unitArg));
+/** Why Gitea's API hides issue state kept outside the issue, which makes a repository's issue records unread. */
+const timeTrackingDisabled = 'Time tracking is disabled; Gitea\'s API hides tracked times.';
+const timeTrackingDisabledInstanceWide = 'Time tracking is disabled instance-wide; Gitea\'s API hides tracked times.';
+const dependenciesDisabled = 'Issue dependencies are disabled; Gitea\'s API hides them.';
+/** Why an imported repository's issues are unread: the poster Gitea's API names is not the author (S8 U3 ruling, Q1). */
+const importedIssues = 'Gitea imported this repository (original_url is set); its API names the importing account as poster and never reports the original author.';
+const projectsOwnerOnly = 'Repository project boards are disabled (projects mode owner); Gitea\'s API hides them.';
 
 /** The value a measure observed so far. */
 const observed = (measureArg: TMeasure): bigint => measureArg.status === 'complete' ? BigInt(measureArg.value)
@@ -351,6 +388,172 @@ const tagProtection = (itemArg: unknown): ITagProtection => {
   };
 };
 
+/** An RFC 3339 time the forge may report as `null`; a missing field still fails. */
+const nullableTimestamp = (valueArg: unknown): string | null => valueArg === null ? null : requiredTimestamp(valueArg);
+
+/** A list Gitea answers as `null` when it is empty. */
+const listed = (valueArg: unknown): unknown[] => {
+  if (valueArg === null) return [];
+  if (!Array.isArray(valueArg)) throw new validation.ForgeInventoryError('invalid-page');
+  return valueArg;
+};
+
+/** Orders signed decimal strings, such as account ids with Gitea's `-1` placeholder, numerically. */
+const compareSigned = (aArg: string, bArg: string): number => {
+  const a = BigInt(aArg);
+  const b = BigInt(bArg);
+  return a < b ? -1 : a > b ? 1 : 0;
+};
+const byId = (aArg: { id: string }, bArg: { id: string }): number => compareDecimal(aArg.id, bArg.id);
+
+const collaborationState = (valueArg: unknown): TCollaborationState => {
+  if (valueArg !== 'open' && valueArg !== 'closed') throw new validation.ForgeInventoryError('invalid-state');
+  return valueArg;
+};
+
+/** An account as a collaboration record names it, verbatim; a deleted account reads as Gitea's placeholder, id -1. */
+const accountRef = (itemArg: unknown): IAccountRef => {
+  const item = validation.record(itemArg);
+  return { id: accountId(item.id), login: requiredString(item.login) };
+};
+
+/**
+ * Gitea's `original_author` and `original_author_id`: null when it reports
+ * none, an empty name with id 0. An id without a name fails.
+ */
+const originalAuthor = (nameArg: unknown, idArg: unknown): IOriginalAuthor | null => {
+  const login = text(nameArg);
+  const id = validation.decimal(idArg);
+  if (login !== '') return { id, login };
+  if (id !== '0') throw new validation.ForgeInventoryError('invalid-original-author');
+  return null;
+};
+
+/** A repository or organization label as Gitea reads it: name and description verbatim, colour without `#` as served. */
+const labelRecord = (itemArg: unknown): ILabel => {
+  const item = validation.record(itemArg);
+  return {
+    id: validation.decimal(item.id),
+    name: text(item.name),
+    color: requiredString(item.color),
+    description: text(item.description),
+    exclusive: requiredBoolean(item.exclusive),
+    archived: requiredBoolean(item.is_archived),
+  };
+};
+
+/** A milestone as Gitea reads it; a time it reports as `null` stays null. */
+const milestoneRecord = (itemArg: unknown): IMilestone => {
+  const item = validation.record(itemArg);
+  return {
+    id: validation.decimal(item.id),
+    title: text(item.title),
+    description: text(item.description),
+    state: collaborationState(item.state),
+    createdAt: requiredTimestamp(item.created_at),
+    updatedAt: nullableTimestamp(item.updated_at),
+    closedAt: nullableTimestamp(item.closed_at),
+    dueOn: nullableTimestamp(item.due_on),
+  };
+};
+
+/** An issue's conversation comment as Gitea reads it, with the number of its reactions. */
+const commentRecord = (itemArg: Record<string, unknown>, reactionsArg: number): IIssueComment => ({
+  id: validation.decimal(itemArg.id),
+  body: text(itemArg.body),
+  createdAt: requiredTimestamp(itemArg.created_at),
+  updatedAt: requiredTimestamp(itemArg.updated_at),
+  author: accountRef(itemArg.user),
+  originalAuthor: originalAuthor(itemArg.original_author, itemArg.original_author_id),
+  attachments: assets(itemArg.assets).count.toString(),
+  reactions: String(reactionsArg),
+});
+
+/**
+ * An issue as Gitea's issue listing reads it, with what it keeps outside the
+ * issue: its comments, reactions, tracked times and dependencies. Title, body
+ * and ref stay verbatim; Gitea's `content_version` is deliberately not
+ * recorded (S8 U1 ruling 8).
+ */
+const issueRecord = (itemArg: Record<string, unknown>, readsArg: {
+  comments: IIssueComment[]; reactions: number; trackedTimes: number; dependencies: number;
+}): IIssue => ({
+  id: validation.decimal(itemArg.id),
+  number: validation.decimal(itemArg.number),
+  title: text(itemArg.title),
+  body: text(itemArg.body),
+  state: collaborationState(itemArg.state),
+  createdAt: requiredTimestamp(itemArg.created_at),
+  updatedAt: requiredTimestamp(itemArg.updated_at),
+  closedAt: nullableTimestamp(itemArg.closed_at),
+  author: accountRef(itemArg.user),
+  originalAuthor: originalAuthor(itemArg.original_author, itemArg.original_author_id),
+  assignees: listed(itemArg.assignees).map(accountRef).sort((aArg, bArg) => compareSigned(aArg.id, bArg.id)),
+  labelIds: listed(itemArg.labels).map((labelArg) => validation.decimal(validation.record(labelArg).id)).sort(compareDecimal),
+  milestoneId: itemArg.milestone === null ? null : validation.decimal(validation.record(itemArg.milestone).id),
+  locked: requiredBoolean(itemArg.is_locked),
+  pinOrder: validation.decimal(itemArg.pin_order),
+  dueDate: nullableTimestamp(itemArg.due_date),
+  ref: text(itemArg.ref),
+  projectIds: listed(itemArg.projects).map((projectArg) => validation.decimal(validation.record(projectArg).id)).sort(compareDecimal),
+  timeEstimate: validation.decimal(itemArg.time_estimate),
+  trackedTimes: String(readsArg.trackedTimes),
+  dependencies: String(readsArg.dependencies),
+  attachments: assets(itemArg.assets).count.toString(),
+  reactions: String(readsArg.reactions),
+  comments: readsArg.comments.sort(byId),
+});
+
+const isPullRequest = (itemArg: Record<string, unknown>): boolean => itemArg.pull_request !== undefined && itemArg.pull_request !== null;
+
+/** What a repository's issue and comment listings hold of one kind, issues or pull requests. */
+interface IKindTally {
+  items: bigint;
+  comments: bigint;
+  /** One measure per listed item and comment. */
+  reactions: TMeasure[];
+  attachments: bigint;
+  attachmentBytes: bigint;
+  add(assetsArg: { count: bigint; bytes: bigint }): void;
+}
+
+const kindTally = (): IKindTally => ({
+  items: 0n, comments: 0n, reactions: [], attachments: 0n, attachmentBytes: 0n,
+  add(assetsArg) {
+    this.attachments += assetsArg.count;
+    this.attachmentBytes += assetsArg.bytes;
+  },
+});
+
+/**
+ * Which kinds a repository's issue listing holds. Gitea lists the issues and
+ * pull requests whose unit is readable, and the issue unit is readable only
+ * as Gitea's own tracker: with an external tracker `has_issues` stays true
+ * but no issue is listed. Each kind is null when listed, else the reason it is
+ * hidden; `tracker` holds the switches of Gitea's own tracker.
+ */
+interface ICollaborationUnits {
+  issues: string | null;
+  pullRequests: string | null;
+  tracker: { timeTracking: boolean; dependencies: boolean } | null;
+}
+
+const collaborationUnits = (itemArg: Record<string, unknown>): ICollaborationUnits => {
+  const hasIssues = requiredBoolean(itemArg.has_issues);
+  const internal = itemArg.internal_tracker === undefined || itemArg.internal_tracker === null ? null : validation.record(itemArg.internal_tracker);
+  const external = itemArg.external_tracker !== undefined && itemArg.external_tracker !== null;
+  if (hasIssues !== (internal !== null || external) || (internal !== null && external)) throw new validation.ForgeInventoryError('inconsistent-issue-unit');
+  return {
+    issues: !hasIssues ? unitDisabledReason('issues')
+      : internal === null ? 'The issues unit is an external tracker; Gitea\'s API lists none of the repository\'s issues.' : null,
+    pullRequests: requiredBoolean(itemArg.has_pull_requests) ? null : unitDisabledReason('pull requests'),
+    tracker: internal === null ? null : {
+      timeTracking: requiredBoolean(internal.enable_time_tracker),
+      dependencies: requiredBoolean(internal.enable_issue_dependencies),
+    },
+  };
+};
+
 /** A `{ <rows>, total_count }` envelope whose rows must match its total. */
 const countedEnvelope = (bodyArg: unknown, rowsKeyArg: string): { rows: unknown[]; failure: string | null } => {
   const body = validation.record(bodyArg);
@@ -367,6 +570,7 @@ const resultUnit = (resultArg: TUnitResult): TUnit => {
     case 'owner': return { kind: 'owner', ownerKind: resultArg.owner.kind, name: resultArg.owner.name };
     case 'repository': return { kind: 'repository', owner: resultArg.repository.owner, name: resultArg.repository.name };
     case 'package': return { kind: 'package', owner: resultArg.package.owner, type: resultArg.package.type, name: resultArg.package.name };
+    case 'collaboration': return { kind: 'collaboration', owner: resultArg.collaboration.owner, name: resultArg.collaboration.name, id: resultArg.collaboration.repositoryId };
     default: return unknownUnit(resultArg);
   }
 };
@@ -383,10 +587,18 @@ const unitKey = (unitArg: TUnit): string => {
     case 'owner': return `owner:${unitArg.ownerKind}:${unitArg.name}`;
     case 'repository': return `repository:${unitArg.owner}/${unitArg.name}`;
     case 'package': return `package:${packageKey(unitArg)}`;
+    // Keyed by the discovered repository id, never by name (S8 ruling D12).
+    case 'collaboration': return `collaboration:${unitArg.id}`;
     default: return unknownUnit(unitArg);
   }
 };
 
+/** A result over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON is a failed unit, never a truncated record. */
+const bounded = (unitArg: TUnit, resultArg: TUnitResult): TUnitResult =>
+  Buffer.byteLength(JSON.stringify(resultArg), 'utf8') > plugins.fossInterfaces.data.forgeSourceInventoryUnitMaxBytes
+    ? { kind: 'failed', unit: unitArg, reason: 'unit-over-bound' }
+    : resultArg;
+
 /** A package type from a listing. */
 const packageType = (valueArg: unknown): string => {
   const type = requiredString(valueArg);
@@ -415,11 +627,13 @@ const compareText = (aArg: string, bArg: string): number => aArg < bArg ? -1 : a
 export class GiteaSourceInventory {
   readonly #options: {
     instanceId: string; baseUrl: string; pageSize: number; maxPages: number; requestTimeoutMs: number; maxResponseBytes: number;
-    token: string; caCertificates?: string[]; gitWorkDir: string; gitTimeoutMs: number;
+    token: string; caCertificates?: string[]; gitWorkDir: string; gitTimeoutMs: number; maxSwiftArchiveBytes: number; packageTransferTimeoutMs: number;
   };
   readonly #transport: transport.TForgeTransport;
   readonly #client: ForgeRequestClient;
   #lfsClient: ForgeRequestClient | null = null;
+  /** The Swift archive GETs, which go through `verifiedPackageDownload` instead of a request client. */
+  readonly #archiveMetrics: IForgeRequestMetrics = { requests: 0, responseBytes: 0, rateLimitedRequests: 0 };
   #readerLogin: Promise<string> | null = null;
 
   constructor(optionsArg: IGiteaSourceInventoryOptions) {
@@ -435,9 +649,12 @@ export class GiteaSourceInventory {
       requestTimeoutMs: optionsArg.requestTimeoutMs ?? 60_000,
       maxResponseBytes: optionsArg.maxResponseBytes ?? 16 * 1024 * 1024,
       gitTimeoutMs: optionsArg.gitTimeoutMs ?? 30 * 60 * 1000,
+      maxSwiftArchiveBytes: optionsArg.maxSwiftArchiveBytes ?? 128 * 1024 * 1024,
+      packageTransferTimeoutMs: optionsArg.packageTransferTimeoutMs ?? 30 * 60 * 1000,
     };
     for (const [name, maximum] of [
       ['pageSize', 100], ['maxPages', 1_000_000], ['requestTimeoutMs', 300_000], ['maxResponseBytes', 64 * 1024 * 1024], ['gitTimeoutMs', 6 * 60 * 60 * 1000],
+      ['maxSwiftArchiveBytes', 1024 * 1024 * 1024], ['packageTransferTimeoutMs', 6 * 60 * 60 * 1000],
     ] as const) {
       const value = limits[name];
       if (!Number.isSafeInteger(value) || value < 1 || value > maximum) throw new validation.ForgeInventoryError('invalid-limits');
@@ -459,28 +676,32 @@ export class GiteaSourceInventory {
   /** Validated, normalized instance root; contains no credentials or API suffix. */
   public get baseUrl(): string { return this.#options.baseUrl; }
 
-  /** REST and LFS batch requests together. */
+  /** REST, registry and LFS batch requests and Swift archive GETs together. */
   public get metrics(): IForgeRequestMetrics {
     const rest = this.#client.metrics;
     const lfs = this.#lfsClient?.metrics ?? { requests: 0, responseBytes: 0, rateLimitedRequests: 0 };
+    const archives = this.#archiveMetrics;
     return {
-      requests: rest.requests + lfs.requests,
-      responseBytes: rest.responseBytes + lfs.responseBytes,
-      rateLimitedRequests: rest.rateLimitedRequests + lfs.rateLimitedRequests,
+      requests: rest.requests + lfs.requests + archives.requests,
+      responseBytes: rest.responseBytes + lfs.responseBytes + archives.responseBytes,
+      rateLimitedRequests: rest.rateLimitedRequests + lfs.rateLimitedRequests + archives.rateLimitedRequests,
     };
   }
 
   /**
    * Identifies the source and its reader and lists every owner and repository
-   * with its id, and with `classes: ['packages']` every package from the
-   * administrator package listing (`packages`, absent otherwise). Rejects
-   * unless the token belongs to a site administrator, and rejects an unknown
-   * class with `invalid-options`; a listing that does not finish, or that
-   * lists a repository id twice, is reported in `incompleteReasons`.
+   * with its id, with `classes: ['packages']` every package from the
+   * administrator package listing (`packages`, absent otherwise), and with
+   * `classes: ['collaboration']` sets `collaboration: true`. Rejects unless
+   * the token belongs to a site administrator, and rejects an unknown class
+   * with `invalid-options`; a listing that does not finish, or that lists a
+   * repository id twice, is reported in `incompleteReasons`.
    */
   public async discover(signalArg?: AbortSignal, optionsArg: IGiteaSourceDiscoveryOptions = {}): Promise<IDiscovery> {
     const classes = optionsArg.classes ?? [];
-    if (!Array.isArray(classes) || classes.some((classArg) => classArg !== 'packages')) throw new validation.ForgeInventoryError('invalid-options');
+    if (!Array.isArray(classes) || classes.some((classArg) => classArg !== 'packages' && classArg !== 'collaboration')) {
+      throw new validation.ForgeInventoryError('invalid-options');
+    }
     const reader = validation.record((await this.#get('/user', { signal: signalArg })).body);
     if (reader.is_admin !== true) throw new validation.ForgeInventoryError('reader-not-site-admin');
     const version = validation.record((await this.#get('/version', { signal: signalArg })).body).version;
@@ -536,6 +757,7 @@ export class GiteaSourceInventory {
       owners,
       repositories: discovered,
       ...(packages === undefined ? {} : { packages }),
+      ...(classes.includes('collaboration') ? { collaboration: true as const } : {}),
       incompleteReasons: incompleteReasons.sort(compareText),
     };
   }
@@ -543,7 +765,10 @@ export class GiteaSourceInventory {
   /**
    * Every unit a run over this discovery measures: the instance, then owners,
    * then repositories, then the packages discovery lists when it selected
-   * them.
+   * them, then, when it selected collaboration, one collaboration unit per
+   * repository, keyed by the repository's id. A discovery that selects
+   * collaboration while a repository has no id rejects with
+   * `repository-id-missing`; it never falls back to keying by name.
    */
   public units(discoveryArg: IDiscovery): TUnit[] {
     return [
@@ -553,6 +778,10 @@ export class GiteaSourceInventory {
         kind: 'repository', owner: repositoryArg.owner, name: repositoryArg.name, ...repositoryArg.id === undefined ? {} : { id: repositoryArg.id },
       })),
       ...(discoveryArg.packages ?? []).map((packageArg): TUnit => ({ kind: 'package', owner: packageArg.owner, type: packageArg.type, name: packageArg.name })),
+      ...(discoveryArg.collaboration === true ? discoveryArg.repositories : []).map((repositoryArg): TUnit => {
+        if (repositoryArg.id === undefined) throw new validation.ForgeInventoryError('repository-id-missing');
+        return { kind: 'collaboration', owner: repositoryArg.owner, name: repositoryArg.name, id: repositoryArg.id };
+      }),
     ];
   }
 
@@ -579,12 +808,13 @@ export class GiteaSourceInventory {
 
   /**
    * Measures one unit. Never rejects: a unit whose primary record cannot be
-   * read is `failed`, and so is a repository unit carrying an id that its name
-   * no longer answers with (`repository-identity-changed`). A package unit is
-   * read whole or fails, never partly: a listing that does not finish, an
-   * index that is not what its file list promises (`unexpected-manifest-shape`)
-   * and a result over `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON
-   * (`unit-over-bound`) fail it, and its record is never truncated.
+   * read is `failed`, and so is a repository or collaboration unit carrying an
+   * id that its name no longer answers with (`repository-identity-changed`).
+   * Package and collaboration units are read whole or fail, never partly: a
+   * listing that does not finish, an index that is not what its file list
+   * promises (`unexpected-manifest-shape`) and a result over
+   * `forgeSourceInventoryUnitMaxBytes` of UTF-8 JSON (`unit-over-bound`) fail
+   * it, and its records are never truncated.
    */
   public async measureUnit(unitArg: TUnit, signalArg?: AbortSignal): Promise<TUnitResult> {
     try {
@@ -595,13 +825,10 @@ export class GiteaSourceInventory {
           return { kind: 'owner', owner: unitArg.ownerKind === 'organization' ? await this.#organization(unitArg.name, signalArg) : await this.#user(unitArg.name, signalArg) };
         case 'repository':
           return { kind: 'repository', repository: await this.#repository(unitArg.owner, unitArg.name, unitArg.id, signalArg) };
-        case 'package': {
-          const result: TUnitResult = { kind: 'package', package: await this.#package(unitArg, signalArg) };
-          if (Buffer.byteLength(JSON.stringify(result), 'utf8') > plugins.fossInterfaces.data.forgeSourceInventoryUnitMaxBytes) {
-            return { kind: 'failed', unit: unitArg, reason: 'unit-over-bound' };
-          }
-          return result;
-        }
+        case 'package':
+          return bounded(unitArg, { kind: 'package', package: await this.#package(unitArg, signalArg) });
+        case 'collaboration':
+          return bounded(unitArg, { kind: 'collaboration', collaboration: await this.#collaborationRecords(unitArg, signalArg) });
         default:
           return unknownUnit(unitArg);
       }
@@ -673,13 +900,16 @@ export class GiteaSourceInventory {
     };
   }
 
-  async #ownerBase(nameArg: string, recordArg: Record<string, unknown>, repositoriesPathArg: string, signalArg?: AbortSignal) {
+  /** Fields every owner has; `pathArg` is the owner's `/orgs/{org}` or `/users/{user}` route, which lists its repositories and project boards. */
+  async #ownerBase(nameArg: string, recordArg: Record<string, unknown>, pathArg: string, signalArg?: AbortSignal) {
     return {
       name: nameArg,
       id: validation.decimal(recordArg.id),
       visibility: ownerVisibility(recordArg.visibility),
-      repositories: await this.#count(repositoriesPathArg, { signal: signalArg }),
+      repositories: await this.#count(`${pathArg}/repos`, { signal: signalArg }),
       packages: await this.#packages(nameArg, signalArg),
+      // Open and closed boards; a site administrator reads those of private owners too.
+      projects: await this.#count(`${pathArg}/projects`, { signal: signalArg, query: { state: 'all' } }),
     };
   }
 
@@ -687,6 +917,7 @@ export class GiteaSourceInventory {
     const path = `/orgs/${encodeURIComponent(nameArg)}`;
     const organization = validation.record((await this.#get(path, { signal: signalArg })).body);
     if (segment(organization.name) !== nameArg) throw new validation.ForgeInventoryError('owner-identity-changed');
+    const labels = await this.#list(`${path}/labels`, { signal: signalArg });
     const teams = await this.#list(`${path}/teams`, { signal: signalArg });
     const memberships: TMeasure[] = [];
     const grants: TMeasure[] = [];
@@ -707,7 +938,7 @@ export class GiteaSourceInventory {
     const teamRepositoryGrants = fromTeams(grants);
     return {
       kind: 'organization',
-      ...await this.#ownerBase(nameArg, organization, `${path}/repos`, signalArg),
+      ...await this.#ownerBase(nameArg, organization, path, signalArg),
       webhooks: await this.#count(`${path}/hooks`, { signal: signalArg }),
       actionsVariables: await this.#count(`${path}/actions/variables`, { signal: signalArg }),
       runners: await this.#runners(`${path}/actions/runners`, { signal: signalArg }),
@@ -715,12 +946,14 @@ export class GiteaSourceInventory {
       teams: teamsMeasure,
       teamMemberships,
       teamRepositoryGrants,
-      labels: await this.#count(`${path}/labels`, { signal: signalArg }),
+      labels: listingMeasure(labels),
       actionsSecrets: await this.#count(`${path}/actions/secrets`, { signal: signalArg }),
       // Never partial: one unfinished listing makes the records null.
       teamRecords: [teamsMeasure, teamMemberships, teamRepositoryGrants].every((measureArg) => measureArg.status === 'complete')
         ? teamRecords.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id))
         : null,
+      // Recorded by every owner unit; the composed inventory keeps them exactly when discovery selects collaboration.
+      labelRecords: labels.failure === null ? labels.items.map(labelRecord).sort(byId) : null,
     };
   }
 
@@ -730,7 +963,7 @@ export class GiteaSourceInventory {
     if (segment(user.login) !== nameArg) throw new validation.ForgeInventoryError('owner-identity-changed');
     // User-scoped settings are only readable as that user, through the administrator's Sudo header.
     const sudo = { signal: signalArg, sudo: nameArg };
-    const base = await this.#ownerBase(nameArg, user, `${path}/repos`, signalArg);
+    const base = await this.#ownerBase(nameArg, user, path, signalArg);
     const flags = {
       admin: requiredBoolean(user.is_admin),
       active: requiredBoolean(user.active),
@@ -805,9 +1038,11 @@ export class GiteaSourceInventory {
    * whose only file is `manifest.json`, are read by digest for their
    * references; no other manifest is read. npm packages add the dist-tags Gitea
    * serves (a derived `latest` included) and each version's deprecation,
-   * Cargo crates each version's yank from the sparse index. Every read is a
-   * GET; reading an index counts a download of its version, an accepted read
-   * stamp (S10 ruling, Addendum 1).
+   * Cargo crates each version's yank from the sparse index, Swift packages
+   * each version's manifests, read from its archive's file names and Gitea's
+   * manifest route. Every read is a GET; reading an index or a Swift archive
+   * counts a download of its version, an accepted read stamp (S10 ruling,
+   * Addendum 1; S10 C5 ruling, Addendum 2).
    */
   async #package(refArg: IPackageRef, signalArg?: AbortSignal): Promise<IPackageRecord> {
     const packagePath = `/packages/${encodeURIComponent(refArg.owner)}/${encodeURIComponent(refArg.type)}/${encodeURIComponent(refArg.name)}`;
@@ -838,11 +1073,11 @@ export class GiteaSourceInventory {
     }
     versions.sort((aArg, bArg) => compareDecimal(aArg.id, bArg.id));
     const blobs = new Map<string, IPackageBlob>();
-    const filesByVersion = new Map<string, Array<{ name: string; sha256: string }>>();
+    const filesByVersion = new Map<string, IVersionFile[]>();
     for (const version of versions) {
       const files = (await this.#get(`${packagePath}/${encodeURIComponent(version.version)}/files`, { signal: signalArg })).body;
       if (!Array.isArray(files)) throw new validation.ForgeInventoryError('invalid-page');
-      const read: Array<{ name: string; sha256: string }> = [];
+      const read: IVersionFile[] = [];
       for (const fileArg of files) {
         const file = validation.record(fileArg);
         const sha256 = requiredString(file.sha256);
@@ -853,7 +1088,7 @@ export class GiteaSourceInventory {
         const name = requiredString(file.name);
         blob.files.push({ versionId: version.id, id: validation.decimal(file.id), name });
         blobs.set(sha256, blob);
-        read.push({ name, sha256 });
+        read.push({ name, sha256, size });
       }
       filesByVersion.set(version.id, read);
     }
@@ -866,6 +1101,7 @@ export class GiteaSourceInventory {
     if (record.type === 'container') await this.#containerReferences(record, filesByVersion, signalArg);
     if (record.type === 'npm') await this.#npmState(record, signalArg);
     if (record.type === 'cargo') await this.#cargoYanks(record, signalArg);
+    if (record.type === 'swift') await this.#swiftManifests(record, filesByVersion, signalArg);
     return record;
   }
 
@@ -876,9 +1112,7 @@ export class GiteaSourceInventory {
    * bytes must hash to the listed SHA-256 and the response must be an index or
    * a manifest list, else the unit fails with `unexpected-manifest-shape`.
    */
-  async #containerReferences(
-    recordArg: IPackageRecord, filesArg: ReadonlyMap<string, Array<{ name: string; sha256: string }>>, signalArg?: AbortSignal,
-  ): Promise<void> {
+  async #containerReferences(recordArg: IPackageRecord, filesArg: ReadonlyMap<string, IVersionFile[]>, signalArg?: AbortSignal): Promise<void> {
     if (!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/.test(recordArg.name)) {
       throw new validation.ForgeInventoryError('invalid-image-name');
     }
@@ -911,6 +1145,69 @@ export class GiteaSourceInventory {
     }
   }
 
+  /**
+   * Each Swift version's `manifests`. Gitea stores one file per version, its
+   * source archive, and anything else fails the unit with
+   * `swift-version-files-unexpected`. An archive over `maxSwiftArchiveBytes`
+   * by its recorded size is not read and records `null`. Otherwise the
+   * archive is read once and verified against its recorded size and SHA-256,
+   * its central directory gives the candidate keys (`swiftManifestCandidates`),
+   * and the manifest route is asked for each: a 200 is recorded with the size
+   * and SHA-256 of the bytes, the 303 to the release's `Package.swift` means
+   * Gitea holds no such manifest, and `''` must answer 200. A failed read
+   * fails the unit; it never records `null`.
+   */
+  async #swiftManifests(recordArg: IPackageRecord, filesArg: ReadonlyMap<string, IVersionFile[]>, signalArg?: AbortSignal): Promise<void> {
+    const parts = swiftPackageParts(recordArg.name);
+    for (const version of recordArg.versions) {
+      const files = filesArg.get(version.id)!;
+      if (files.length !== 1) throw new validation.ForgeInventoryError('swift-version-files-unexpected');
+      // The native store's comparison: an archive of exactly the bound is held.
+      if (BigInt(files[0].size) > BigInt(this.#options.maxSwiftArchiveBytes)) {
+        version.manifests = null;
+        continue;
+      }
+      const keys = swiftManifestCandidates(await this.#swiftArchive(recordArg, parts, version, files[0], signalArg));
+      const manifests: ISwiftManifest[] = [];
+      for (const key of keys) {
+        const manifest = await readSwiftManifest(this.#client, this.#options.baseUrl, recordArg.owner, parts, version.version, key === '' ? null : key, signalArg);
+        if (manifest === null) continue;
+        manifests.push({ key, size: manifest.bytes.byteLength, sha256: plugins.crypto.createHash('sha256').update(manifest.bytes).digest('hex') });
+      }
+      version.manifests = manifests;
+    }
+  }
+
+  /**
+   * A Swift version's source archive, read once with the reader's `token`
+   * authorization through `verifiedPackageDownload` (exact size, SHA-256
+   * before the last chunk) into one buffer of the recorded size. The read
+   * counts a download of the version, an accepted read stamp (S10 ruling
+   * item 8; S10 C5 ruling, Addendum 2).
+   */
+  async #swiftArchive(
+    recordArg: IPackageRecord, partsArg: { scope: string; name: string }, versionArg: IPackageVersion, fileArg: IVersionFile, signalArg?: AbortSignal,
+  ): Promise<Buffer> {
+    const url = new URL(`${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/swift/${encodeURIComponent(partsArg.scope)}/${
+      encodeURIComponent(partsArg.name)}/${encodeURIComponent(versionArg.version)}.zip`);
+    const bytes = Number(fileArg.size);
+    const stream = await verifiedPackageDownload(
+      {
+        caCertificates: this.#options.caCertificates, packageTransferTimeoutMs: this.#options.packageTransferTimeoutMs,
+        requestTimeoutMs: this.#options.requestTimeoutMs, metrics: this.#archiveMetrics,
+      },
+      url, { authorization: `token ${this.#options.token}`, accept: 'application/vnd.swift.registry.v1+zip' },
+      { sha256: fileArg.sha256, size: fileArg.size, bytes }, signalArg, null,
+    );
+    const archive = Buffer.alloc(bytes);
+    let offset = 0;
+    for await (const chunk of stream as AsyncIterable<Uint8Array>) {
+      archive.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return archive;
+  }
+
   /** Every dist-tag Gitea serves, a `latest` it derives included, and each version's deprecation from the package document. */
   async #npmState(recordArg: IPackageRecord, signalArg?: AbortSignal): Promise<void> {
     const registry = `${this.#options.baseUrl}/api/packages/${encodeURIComponent(recordArg.owner)}/npm`;
@@ -981,6 +1278,12 @@ export class GiteaSourceInventory {
     const fork = requiredBoolean(item.fork);
     const parent = item.parent === undefined || item.parent === null ? null : requiredString(validation.record(item.parent).full_name);
     if (fork !== (parent !== null)) throw new validation.ForgeInventoryError('inconsistent-fork-parent');
+    const units = collaborationUnits(item);
+    const projectsMode = requiredString(item.projects_mode);
+    if (!['repo', 'owner', 'all'].includes(projectsMode)) throw new validation.ForgeInventoryError('invalid-projects-mode');
+    // Gitea 28.2.0 serves a repository's boards while its projects unit is disabled (it then reports `projects_mode` `all`), and hides
+    // them only while the unit allows owner boards alone.
+    const projectsHidden = projectsMode === 'owner' ? projectsOwnerOnly : null;
     const options = { signal: signalArg };
     const branchRules = await this.#unpaged(`${path}/branch_protections`, options);
     const tagRules = await this.#unpaged(`${path}/tag_protections`, options);
@@ -1003,7 +1306,7 @@ export class GiteaSourceInventory {
       description: text(item.description),
       features,
       ...await this.#git(ownerArg, nameArg, item, signalArg),
-      collaboration: await this.#collaboration(path, features, archived, signalArg),
+      collaboration: await this.#collaboration(path, units, projectsHidden, archived, signalArg),
       // Releases stay readable while their unit is disabled; a disabled wiki answers 404.
       ...await this.#releases(path, signalArg),
       wikiPages: features.wiki ? await this.#count(`${path}/wiki/pages`, { ...options, missingIsEmpty: true }) : unitDisabled('wiki'),
@@ -1121,64 +1424,202 @@ export class GiteaSourceInventory {
     return this.#lfsClient;
   }
 
-  async #collaboration(pathArg: string, featuresArg: IRepository['features'], archivedArg: boolean, signalArg?: AbortSignal): Promise<IRepository['collaboration']> {
+  /**
+   * A repository's issue and pull request measures, read apart (S8 ruling,
+   * G2). Gitea's issue listing and repository comment listing leave out the
+   * kind whose unit is not readable (`ListIssues`, `ListRepoIssueComments` of
+   * Gitea 28.2.0) and answer 404 only when neither is, so a disabled pull
+   * request unit leaves every issue measure measured, and the reverse. A
+   * comment's kind is the one of its two URL fields Gitea fills; neither URL
+   * is kept. Each mixed measure is the sum of its two kinds, so it is not
+   * measured while either kind is hidden.
+   */
+  async #collaboration(
+    pathArg: string, unitsArg: ICollaborationUnits, projectsHiddenArg: string | null, archivedArg: boolean, signalArg?: AbortSignal,
+  ): Promise<ICollaborationCounts> {
     const options = { signal: signalArg };
-    // Labels and milestones stay readable while the issue units are disabled.
+    // Labels and milestones stay readable while the issue and pull request units are disabled.
     const labels = await this.#count(`${pathArg}/labels`, options);
     const milestones = await this.#count(`${pathArg}/milestones`, { ...options, query: { state: 'all' } });
-    if (!featuresArg.issues || !featuresArg.pullRequests) {
-      // A disabled unit silently drops its items from the shared issue listing; with both disabled the listings answer 404.
-      const hidden = unitDisabled(featuresArg.issues ? 'pull requests' : 'issues');
-      return {
-        issues: hidden, pullRequests: hidden, comments: hidden, reviews: hidden, reviewComments: hidden,
-        labels, milestones, reactions: hidden, attachments: hidden, attachmentBytes: hidden,
-      };
-    }
+    const projects = projectsHiddenArg === null ? await this.#count(`${pathArg}/projects`, { ...options, query: { state: 'all' } }) : notMeasured(projectsHiddenArg);
+    const listed = unitsArg.issues === null || unitsArg.pullRequests === null;
     // Issues and pull requests share one listing and one number sequence.
-    const issues = await this.#list(`${pathArg}/issues`, { ...options, query: { state: 'all' } });
-    const unfinished = issues.failure === null ? [] : [partial(0, issues.failure)];
-    let issueCount = 0n;
-    let pullCount = 0n;
-    let attachments = { count: 0n, bytes: 0n };
-    const reactions: TMeasure[] = [...unfinished];
+    const items: IListing = listed ? await this.#list(`${pathArg}/issues`, { ...options, query: { state: 'all' } }) : { items: [], failure: null };
+    const unfinished = items.failure === null ? [] : [partial(0, items.failure)];
+    const tallies = { issue: kindTally(), pull: kindTally() };
+    const states = { open: 0n, closed: 0n, merged: 0n };
     const reviews: TMeasure[] = [...unfinished];
     const reviewComments: TMeasure[] = [...unfinished];
-    for (const itemArg of issues.items) {
+    for (const itemArg of items.items) {
       const item = validation.record(itemArg);
       const number = validation.decimal(item.number);
-      const isPull = item.pull_request !== undefined && item.pull_request !== null;
-      if (isPull) pullCount++; else issueCount++;
-      const itemAssets = assets(item.assets);
-      attachments = { count: attachments.count + itemAssets.count, bytes: attachments.bytes + itemAssets.bytes };
-      reactions.push(await this.#count(`${pathArg}/issues/${number}/reactions`, { ...options, nullIsEmpty: true }));
-      if (isPull) {
+      const pull = isPullRequest(item);
+      const tally = pull ? tallies.pull : tallies.issue;
+      tally.items++;
+      tally.add(assets(item.assets));
+      tally.reactions.push(await this.#count(`${pathArg}/issues/${number}/reactions`, { ...options, nullIsEmpty: true }));
+      if (pull) {
+        const state = collaborationState(item.state);
+        // A merged pull request is closed.
+        if (requiredBoolean(validation.record(item.pull_request).merged)) {
+          if (state === 'open') throw new validation.ForgeInventoryError('inconsistent-pull-request-state');
+          states.merged++;
+        } else {
+          states[state]++;
+        }
         const pullReviews = await this.#pullList(`${pathArg}/pulls/${number}/reviews`, archivedArg, options);
         reviews.push(listingMeasure(pullReviews));
         const inline = pullReviews.items.reduce((sumArg: bigint, reviewArg: unknown) => sumArg + BigInt(validation.decimal(validation.record(reviewArg).comments_count)), 0n);
         reviewComments.push(listingMeasure(pullReviews, inline));
       }
     }
-    const comments = await this.#list(`${pathArg}/issues/comments`, options);
+    const comments: IListing = listed ? await this.#list(`${pathArg}/issues/comments`, options) : { items: [], failure: null };
     const commentUnfinished = comments.failure === null ? [] : [partial(0, comments.failure)];
     for (const commentArg of comments.items) {
       const comment = validation.record(commentArg);
-      const commentAssets = assets(comment.assets);
-      attachments = { count: attachments.count + commentAssets.count, bytes: attachments.bytes + commentAssets.bytes };
-      reactions.push(await this.#unpagedCount(`${pathArg}/issues/comments/${validation.decimal(comment.id)}/reactions`, { ...options, nullIsEmpty: true }));
+      const onIssue = text(comment.issue_url) !== '';
+      if (onIssue === (text(comment.pull_request_url) !== '')) throw new validation.ForgeInventoryError('invalid-comment-kind');
+      const tally = onIssue ? tallies.issue : tallies.pull;
+      tally.comments++;
+      tally.add(assets(comment.assets));
+      tally.reactions.push(await this.#unpagedCount(`${pathArg}/issues/comments/${validation.decimal(comment.id)}/reactions`, { ...options, nullIsEmpty: true }));
     }
-    const attachmentUnfinished = [...unfinished, ...commentUnfinished];
+    const measures = (hiddenArg: string | null, tallyArg: IKindTally) => {
+      if (hiddenArg !== null) {
+        const hidden = notMeasured(hiddenArg);
+        return { items: hidden, comments: hidden, reactions: hidden, attachments: hidden, attachmentBytes: hidden };
+      }
+      return {
+        items: listingMeasure(items, tallyArg.items),
+        comments: listingMeasure(comments, tallyArg.comments),
+        reactions: sumMeasures([...unfinished, ...tallyArg.reactions, ...commentUnfinished]),
+        attachments: sumMeasures([complete(tallyArg.attachments), ...unfinished, ...commentUnfinished]),
+        attachmentBytes: sumMeasures([complete(tallyArg.attachmentBytes), ...unfinished, ...commentUnfinished]),
+      };
+    };
+    const issues = measures(unitsArg.issues, tallies.issue);
+    const pulls = measures(unitsArg.pullRequests, tallies.pull);
+    const pullOnly = (measureArg: () => TMeasure): TMeasure => unitsArg.pullRequests === null ? measureArg() : notMeasured(unitsArg.pullRequests);
     return {
-      issues: listingMeasure(issues, issueCount),
-      pullRequests: listingMeasure(issues, pullCount),
-      comments: listingMeasure(comments),
-      reviews: sumMeasures(reviews),
-      reviewComments: sumMeasures(reviewComments),
+      issues: issues.items,
+      pullRequests: pulls.items,
+      comments: sumMeasures([issues.comments, pulls.comments]),
+      reviews: pullOnly(() => sumMeasures(reviews)),
+      reviewComments: pullOnly(() => sumMeasures(reviewComments)),
       labels,
       milestones,
-      reactions: sumMeasures([...reactions, ...commentUnfinished]),
-      attachments: sumMeasures([complete(attachments.count), ...attachmentUnfinished]),
-      attachmentBytes: sumMeasures([complete(attachments.bytes), ...attachmentUnfinished]),
+      reactions: sumMeasures([issues.reactions, pulls.reactions]),
+      attachments: sumMeasures([issues.attachments, pulls.attachments]),
+      attachmentBytes: sumMeasures([issues.attachmentBytes, pulls.attachmentBytes]),
+      byKind: {
+        issueComments: issues.comments,
+        pullRequestComments: pulls.comments,
+        issueReactions: issues.reactions,
+        pullRequestReactions: pulls.reactions,
+        issueAttachments: issues.attachments,
+        issueAttachmentBytes: issues.attachmentBytes,
+        pullRequestAttachments: pulls.attachments,
+        pullRequestAttachmentBytes: pulls.attachmentBytes,
+        openPullRequests: pullOnly(() => listingMeasure(items, states.open)),
+        closedPullRequests: pullOnly(() => listingMeasure(items, states.closed)),
+        mergedPullRequests: pullOnly(() => listingMeasure(items, states.merged)),
+      },
+      projects,
+    };
+  }
+
+  /**
+   * One repository's labels, milestones and issues with their comments, the
+   * collaboration unit (S8 ruling D12, U3), all read with GETs as the
+   * administrator. The repository must still answer its name with the
+   * discovered id, else `repository-identity-changed`. Labels and milestones
+   * stay readable while the issue and pull request units are disabled. One
+   * issue listing gives `highestNumber` over both kinds Gitea lists; it is not
+   * measured when it lists neither. The issue records are `notMeasured`,
+   * without any read of them, when the issue unit is not readable, or when
+   * Gitea's API would refuse the tracked times or dependencies of every issue
+   * (time tracking off for the repository or the instance, dependencies off),
+   * since a refused read must never count as none (S8 U1 ruling, Conditions).
+   * They are also `notMeasured`, without any read of an issue, when Gitea
+   * imported the repository (`original_url` set) and the listing holds an
+   * issue: Gitea 28.2.0's API names the importing account as every imported
+   * issue's and comment's poster and never reports the original author, so
+   * recording them would credit the wrong account (S8 U3 ruling, Q1). An
+   * imported repository without issues stays a complete empty list. Any
+   * failed read fails the unit; a resumed run measures it again.
+   */
+  async #collaborationRecords(unitArg: { owner: string; name: string; id: string }, signalArg?: AbortSignal): Promise<ICollaboration> {
+    const path = `/repos/${encodeURIComponent(unitArg.owner)}/${encodeURIComponent(unitArg.name)}`;
+    const options = { signal: signalArg };
+    const item = validation.record((await this.#get(path, options)).body);
+    if (segment(validation.record(item.owner).login) !== unitArg.owner || segment(item.name) !== unitArg.name || validation.decimal(item.id) !== unitArg.id) {
+      throw new validation.ForgeInventoryError('repository-identity-changed');
+    }
+    // Gitea sanitizes it, but it is still never recorded: only whether it is set decides.
+    const imported = text(item.original_url) !== '';
+    const units = collaborationUnits(item);
+    const labels = (await this.#rows(`${path}/labels`, options)).map(labelRecord).sort(byId);
+    const milestones = (await this.#rows(`${path}/milestones`, { ...options, query: { state: 'all' } })).map(milestoneRecord).sort(byId);
+    const unit = {
+      owner: unitArg.owner, name: unitArg.name, repositoryId: unitArg.id,
+      labels: { status: 'complete' as const, records: labels }, milestones: { status: 'complete' as const, records: milestones },
     };
+    if (units.issues !== null && units.pullRequests !== null) {
+      return {
+        ...unit,
+        highestNumber: notMeasured('The issues and pull requests units are disabled; Gitea\'s API lists neither.'),
+        issues: { status: 'notMeasured', reason: units.issues },
+      };
+    }
+    // Issues and pull requests share one listing and one number sequence; a number listed twice means the listing shifted.
+    const items = (await this.#rows(`${path}/issues`, { ...options, query: { state: 'all' } })).map(validation.record);
+    const numbers = new Set(items.map((itemArg) => validation.decimal(itemArg.number)));
+    if (numbers.size !== items.length) throw new validation.ForgeInventoryError('duplicate-number');
+    const highestNumber = complete([...numbers].reduce((maximumArg, numberArg) => BigInt(numberArg) > maximumArg ? BigInt(numberArg) : maximumArg, 0n));
+    const hidden = units.issues
+      ?? (imported && items.some((itemArg) => !isPullRequest(itemArg)) ? importedIssues : null)
+      ?? await this.#hiddenIssueState(units.tracker!, options);
+    if (hidden !== null) return { ...unit, highestNumber, issues: { status: 'notMeasured', reason: hidden } };
+    const milestoneIds = new Set(milestones.map((milestoneArg) => milestoneArg.id));
+    const issues: IIssue[] = [];
+    for (const issueItem of items) {
+      if (isPullRequest(issueItem)) continue;
+      const issue = await this.#issue(path, issueItem, options);
+      if (issue.milestoneId !== null && !milestoneIds.has(issue.milestoneId)) throw new validation.ForgeInventoryError('issue-milestone-unlisted');
+      issues.push(issue);
+    }
+    return { ...unit, highestNumber, issues: { status: 'complete', records: issues.sort((aArg, bArg) => compareDecimal(aArg.number, bArg.number)) } };
+  }
+
+  /**
+   * Why Gitea's API would refuse every issue's tracked times or dependencies,
+   * null when it serves both: its `/issues/{index}/times` answers 404 while
+   * time tracking is off for the repository or the instance, and
+   * `/issues/{index}/dependencies` while dependencies are off.
+   */
+  async #hiddenIssueState(trackerArg: { timeTracking: boolean; dependencies: boolean }, optionsArg: IListOptions): Promise<string | null> {
+    if (!trackerArg.dependencies) return dependenciesDisabled;
+    if (!trackerArg.timeTracking) return timeTrackingDisabled;
+    const settings = validation.record((await this.#get('/settings/repository', optionsArg)).body);
+    return requiredBoolean(settings.time_tracking_disabled) ? timeTrackingDisabledInstanceWide : null;
+  }
+
+  /** One issue with its comments, each comment's reactions, and its reactions, tracked times and dependencies. */
+  async #issue(pathArg: string, itemArg: Record<string, unknown>, optionsArg: IListOptions): Promise<IIssue> {
+    const issuePath = `${pathArg}/issues/${validation.decimal(itemArg.number)}`;
+    const comments: IIssueComment[] = [];
+    // Gitea answers an issue's comments and a comment's reactions whole, ignoring pages.
+    for (const commentArg of await this.#wholeRows(`${issuePath}/comments`, optionsArg)) {
+      const comment = validation.record(commentArg);
+      const reactions = await this.#wholeRows(`${pathArg}/issues/comments/${validation.decimal(comment.id)}/reactions`, { ...optionsArg, nullIsEmpty: true });
+      comments.push(commentRecord(comment, reactions.length));
+    }
+    return issueRecord(itemArg, {
+      comments,
+      reactions: (await this.#rows(`${issuePath}/reactions`, { ...optionsArg, nullIsEmpty: true })).length,
+      trackedTimes: (await this.#rows(`${issuePath}/times`, optionsArg)).length,
+      dependencies: (await this.#rows(`${issuePath}/dependencies`, optionsArg)).length,
+    });
   }
 
   /**
@@ -1289,6 +1730,23 @@ export class GiteaSourceInventory {
     return listingMeasure(await this.#list(pathArg, optionsArg));
   }
 
+  /** Every row of a paged listing; a listing that does not finish rejects with its reason, so records are never partial. */
+  async #rows(pathArg: string, optionsArg: IListOptions): Promise<unknown[]> {
+    const listing = await this.#list(pathArg, optionsArg);
+    if (listing.failure !== null) throw new validation.ForgeInventoryError(listing.failure);
+    return listing.items;
+  }
+
+  /** A listing Gitea answers whole on one request, ignoring pages; its rows must match the `X-Total-Count` Gitea sends with it. */
+  async #wholeRows(pathArg: string, optionsArg: IListOptions): Promise<unknown[]> {
+    const response = await this.#get(pathArg, optionsArg);
+    const rows = response.body === null && optionsArg.nullIsEmpty ? [] : response.body;
+    if (!Array.isArray(rows)) throw new validation.ForgeInventoryError('invalid-page');
+    const total = response.headers.get('x-total-count');
+    if (total !== null && validation.decimal(total) !== String(rows.length)) throw new validation.ForgeInventoryError('count-mismatch');
+    return rows;
+  }
+
   /**
    * Reads every page of a listing. It ends at an empty page or once the rows
    * reach `X-Total-Count`, and is partial when the total disagrees with the
@@ -1352,6 +1810,15 @@ const indicator = (measureArg: TMeasure, predicateArg: (valueArg: bigint) => boo
 
 /** A repository result from a generator that predates the deploy token count, whose `deployKeys` included the tokens. */
 const deployTokensPredated = notMeasured('Measured by a generator that predates the deploy token count.');
+/** A repository or owner result from a generator that predates the project board count. */
+const projectsPredated = notMeasured('Measured by a generator that predates the project board count.');
+/** A repository result from a generator that predates the collaboration measures by kind. */
+const kindPredated = notMeasured('Measured by a generator that predates the collaboration measures by kind.');
+const kindsPredated: ICollaborationKindCounts = {
+  issueComments: kindPredated, pullRequestComments: kindPredated, issueReactions: kindPredated, pullRequestReactions: kindPredated,
+  issueAttachments: kindPredated, issueAttachmentBytes: kindPredated, pullRequestAttachments: kindPredated, pullRequestAttachmentBytes: kindPredated,
+  openPullRequests: kindPredated, closedPullRequests: kindPredated, mergedPullRequests: kindPredated,
+};
 
 /** Every measure of a document with its dotted path. */
 const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: string; measure: TMeasure }>) => {
@@ -1379,7 +1846,11 @@ const measuresOf = (valueArg: unknown, pathArg: string, outArg: Array<{ path: st
  * `packages` and `totals.packageContent` (`composeGiteaPackageContent`) are
  * present exactly when discovery lists packages, an empty list included; a
  * package without a record is left out, never truncated, and makes its
- * content measures partial.
+ * content measures partial. `collaboration` and every organization's
+ * `labelRecords` are present exactly when discovery selects collaboration: a
+ * repository without a collaboration result for its discovered id is left
+ * out and named in the reasons, and a record list that is not measured is a
+ * reason by its path, such as `collaboration.issues`.
  */
 export const composeGiteaSourceInventory = (
   discoveryArg: IDiscovery,
@@ -1404,11 +1875,21 @@ export const composeGiteaSourceInventory = (
     };
   }
 
+  const collaborationSelected = discoveryArg.collaboration === true;
+  /** An organization keeps its label records exactly when discovery selects collaboration. */
+  const ownerOfRun = (ownerArg: TOwner): TOwner => {
+    if (ownerArg.kind !== 'organization') return ownerArg;
+    const { labelRecords, ...organization } = ownerArg;
+    if (!collaborationSelected) return organization;
+    if (labelRecords !== undefined) return { ...organization, labelRecords };
+    addReason('organization.labelRecords: Measured by a generator that predates organization label records.');
+    return { ...organization, labelRecords: null };
+  };
   const owners: TOwner[] = [];
   const failedOwners: string[] = [];
   for (const owner of discoveryArg.owners) {
     const result = results.get(unitKey({ kind: 'owner', ownerKind: owner.kind, name: owner.name }));
-    if (result?.kind === 'owner') owners.push(result.owner);
+    if (result?.kind === 'owner') owners.push(ownerOfRun(result.owner));
     else {
       failedOwners.push(owner.name);
       addReason(`${owner.kind}: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : 'unit not measured'}`);
@@ -1436,6 +1917,24 @@ export const composeGiteaSourceInventory = (
     }
     packages.sort(comparePackages);
   }
+  // Collaborations only when discovery selected them, keyed by the discovered repository id, never by name.
+  let collaboration: ICollaboration[] | undefined;
+  if (collaborationSelected) {
+    collaboration = [];
+    for (const repository of discoveryArg.repositories) {
+      if (repository.id === undefined) {
+        addReason('collaboration: repository-id-missing');
+        continue;
+      }
+      const result = results.get(unitKey({ kind: 'collaboration', owner: repository.owner, name: repository.name, id: repository.id }));
+      if (result?.kind === 'collaboration' && result.collaboration.owner === repository.owner && result.collaboration.name === repository.name) {
+        collaboration.push(result.collaboration);
+      } else {
+        addReason(`collaboration: ${result?.kind === 'failed' ? `unit failed: ${result.reason}` : result?.kind === 'collaboration' ? 'unit failed: repository-identity-changed' : 'unit not measured'}`);
+      }
+    }
+    collaboration.sort((aArg, bArg) => compareText(aArg.owner, bArg.owner) || compareText(aArg.name, bArg.name));
+  }
   // Without discovered ids, two names measured as one id show a rename between their units.
   if (new Set(repositories.map((repositoryArg) => repositoryArg.id)).size !== repositories.length) addReason('repository: duplicate-id');
   owners.sort((aArg, bArg) => compareText(aArg.kind, bArg.kind) || compareText(aArg.name, bArg.name));
@@ -1473,6 +1972,7 @@ export const composeGiteaSourceInventory = (
     owners,
     repositories,
     ...(packages === undefined ? {} : { packages }),
+    ...(collaboration === undefined ? {} : { collaboration }),
     totals: {
       organizations: instance.organizations,
       users: instance.users.total,
@@ -1490,8 +1990,15 @@ export const composeGiteaSourceInventory = (
       git: sumGroup(repositories.map((repositoryArg) => repositoryArg.git),
         ['reportedSizeKiB', 'branches', 'tags', 'pullRequestRefs', 'otherRefs', 'objects', 'objectBytes'], missingRepositories),
       lfs: sumGroup(repositories.map((repositoryArg) => repositoryArg.lfs), ['objects', 'bytes', 'missingObjects'], missingRepositories),
-      collaboration: sumGroup(repositories.map((repositoryArg) => repositoryArg.collaboration),
-        ['issues', 'pullRequests', 'comments', 'reviews', 'reviewComments', 'labels', 'milestones', 'reactions', 'attachments', 'attachmentBytes'], missingRepositories),
+      collaboration: {
+        ...sumGroup(repositories.map(({ collaboration: { byKind: _byKind, projects: _projects, ...counts } }) => counts),
+          ['issues', 'pullRequests', 'comments', 'reviews', 'reviewComments', 'labels', 'milestones', 'reactions', 'attachments', 'attachmentBytes'], missingRepositories),
+        byKind: sumGroup(repositories.map((repositoryArg) => repositoryArg.collaboration.byKind ?? kindsPredated), [
+          'issueComments', 'pullRequestComments', 'issueReactions', 'pullRequestReactions', 'issueAttachments', 'issueAttachmentBytes',
+          'pullRequestAttachments', 'pullRequestAttachmentBytes', 'openPullRequests', 'closedPullRequests', 'mergedPullRequests',
+        ], missingRepositories),
+        projects: sumMeasures([...repositories.map((repositoryArg) => repositoryArg.collaboration.projects ?? projectsPredated), ...missingRepositories]),
+      },
       releases: sumGroup(repositories.map((repositoryArg) => repositoryArg.releases), ['releases', 'drafts', 'assets', 'assetBytes'], missingRepositories),
       wikiPages: sumMeasures([...repositories.map((repositoryArg) => repositoryArg.wikiPages), ...missingRepositories]),
       access: sumGroup(repositories.map((repositoryArg): Required<IAccessCounts> => ({
@@ -1526,11 +2033,19 @@ export const composeGiteaSourceInventory = (
   for (const owner of owners) {
     const { name: _name, id: _id, ...measures } = owner;
     measuresOf(measures, owner.kind, collected);
+    if (owner.projects === undefined) collected.push({ path: `${owner.kind}.projects`, measure: projectsPredated });
   }
   for (const repository of repositories) {
     measuresOf(repository, 'repository', collected);
     // A stored result from a generator before deploy tokens counted them among its deploy keys.
     if (repository.access.deployTokens === undefined) collected.push({ path: 'repository.access.deployTokens', measure: deployTokensPredated });
+    if (repository.collaboration.byKind === undefined) collected.push({ path: 'repository.collaboration.byKind', measure: kindPredated });
+    if (repository.collaboration.projects === undefined) collected.push({ path: 'repository.collaboration.projects', measure: projectsPredated });
+  }
+  // A record list that is not measured is a gap by its path, such as `collaboration.issues`; a complete one is never read as a value.
+  for (const entry of collaboration ?? []) {
+    const { owner: _owner, name: _name, repositoryId: _repositoryId, ...measures } = entry;
+    measuresOf(measures, 'collaboration', collected);
   }
   for (const { path, measure } of collected) {
     if (measure.status !== 'complete') addReason(`${path}: ${measure.reason}`);