refactor(artifacts): unify inventory integrity policy

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -112,7 +112,7 @@ export const reconstructJavaScriptArtifact = async (
       {
         resourceScope: scope,
         signal,
-        integrity: { mode: input.integrity_policy },
+        integrity: input.integrity_policy,
         asarHeaderAdmission,
       },
       undefined,

src/artifacts/ArtifactProvider.ts

@@ -522,7 +522,7 @@ class ArtifactClient implements AnalysisClient {
         this.settings,
       ),
       ...(options?.signal === undefined ? {} : { signal: options.signal }),
-      integrity: { mode: parsed.integrity_policy },
+      integrity: parsed.integrity_policy,
     });
   }
 }

src/artifacts/extraction/ArtifactExtraction.ts

@@ -99,7 +99,7 @@ const extractArtifactInScope = async (
         asarHeaderAdmission:
           input.asarHeaderAdmission ??
           resolveAsarHeaderAdmission(input.environment),
-        integrity: { mode: input.integrityPolicy },
+        integrity: input.integrityPolicy,
       },
       admission.probeFacts,
     );

src/artifacts/inventory/scanCanonical.ts

@@ -47,10 +47,7 @@ import {
   scanReader,
   type PendingIntegrityContradiction,
 } from "./scanReader.js";
-import {
-  STRICT_INTEGRITY_POLICY,
-  type ArtifactInventoryOptions,
-} from "./types.js";
+import type { ArtifactInventoryOptions } from "./types.js";
 
 export interface TransferredArtifactInventorySource {
   readonly owner: ArtifactResourceOwner;
@@ -104,7 +101,6 @@ const scanCanonical = async (
   readonly snapshot: ArtifactInventorySnapshot;
   readonly transferredSource: TransferredArtifactInventorySource | undefined;
 }> => {
-  const integrity = options.integrity ?? STRICT_INTEGRITY_POLICY;
   const metadata = await lstat(path);
   const {
     format: rootFormat,
@@ -149,7 +145,7 @@ const scanCanonical = async (
       reader,
       ownedReaders,
       options.signal,
-      integrity,
+      options.integrity,
       options.asarHeaderAdmission,
     );
     outcome = {

src/artifacts/inventory/scanReader.ts

@@ -31,10 +31,7 @@ import {
   resolveOccurrenceParents,
   type MutableOccurrence,
 } from "./ArtifactGraphConstruction.js";
-import {
-  STRICT_INTEGRITY_POLICY,
-  type ArtifactIntegrityPolicy,
-} from "./types.js";
+import type { ArtifactIntegrityPolicyName } from "../../domain/artifactIntegrityPolicy.js";
 import { abortIfNeeded, hashReadable } from "../ArtifactHash.js";
 
 export interface PendingIntegrityContradiction {
@@ -56,7 +53,7 @@ const emptyScan = (): {
 interface ScanContext {
   readonly reader: ArtifactReader;
   readonly signal: AbortSignal | undefined;
-  readonly integrity: ArtifactIntegrityPolicy;
+  readonly integrity: ArtifactIntegrityPolicyName;
   readonly asarHeaderAdmission: AsarHeaderAdmission | undefined;
   readonly nodes: Map<string, ArtifactNode>;
   readonly occurrences: MutableOccurrence[];
@@ -72,7 +69,7 @@ export const scanReader = async (
   reader: ArtifactReader | undefined,
   ownedReaders: ArtifactReader[],
   signal?: AbortSignal,
-  integrity: ArtifactIntegrityPolicy = STRICT_INTEGRITY_POLICY,
+  integrity: ArtifactIntegrityPolicyName = "fail",
   asarHeaderAdmission?: AsarHeaderAdmission,
 ): Promise<{
   readonly nodes: Map<string, ArtifactNode>;
@@ -327,7 +324,7 @@ const digestArtifactEntry = async (
     );
   const mismatched = claim !== null && claim.digest !== observed;
   if (mismatched && claim !== null && observed !== undefined) {
-    if (context.integrity.mode === "fail")
+    if (context.integrity === "fail")
       throw new ArtifactReaderFailure(
         "integrity",
         `Artifact integrity metadata disagrees with content: ${logicalPath}`,

src/artifacts/inventory/types.ts

@@ -1,15 +1,7 @@
+import type { ArtifactIntegrityPolicyName } from "../../domain/artifactIntegrityPolicy.js";
 import type { AsarHeaderAdmission } from "../../config/asarHeaderAdmission.js";
 import type { ArtifactResourceScope } from "../ArtifactResourceScope.js";
 
-/** Resolved integrity behavior admitted to the artifact scanner. */
-export type ArtifactIntegrityPolicy =
-  | { readonly mode: "fail" }
-  | { readonly mode: "record-and-continue" };
-
-export const STRICT_INTEGRITY_POLICY: ArtifactIntegrityPolicy = {
-  mode: "fail",
-};
-
 /** Options shared by artifact inventory scans. */
 export interface ArtifactInventoryOptions {
   readonly resourceScope: ArtifactResourceScope;
@@ -18,7 +10,7 @@ export interface ArtifactInventoryOptions {
   /** Independently selected root spelling used only for ASAR companion lookup. */
   readonly selectedPath?: string | undefined;
   readonly signal?: AbortSignal | undefined;
-  readonly integrity?: ArtifactIntegrityPolicy | undefined;
+  readonly integrity?: ArtifactIntegrityPolicyName | undefined;
   readonly environment?: Readonly<NodeJS.ProcessEnv> | undefined;
   /** ASAR header/index admission resolved from the owner's environment; default when absent. */
   readonly asarHeaderAdmission?: AsarHeaderAdmission | undefined;

tests/boundary/filesystem/asarInventoryContainment.test.ts

@@ -192,7 +192,7 @@ describe("expanded ASAR inventory containment", () => {
       reason: "integrity",
     });
     const observed = await inventoryArtifact(application, {
-      integrity: { mode: "record-and-continue" },
+      integrity: "record-and-continue",
     });
     const container = artifactOccurrenceAt(observed, "resources/app.asar");
     const child = artifactOccurrenceAt(observed, "resources/app.asar/main.js");

tests/boundary/filesystem/asarSelectedCompanion.test.ts

@@ -98,7 +98,7 @@ it.skipIf(process.platform === "win32")(
     expect(extractFile(selected, "native.node").equals(bytes)).toBe(true);
     const selectedInventory = await inventoryArtifact(selected);
     const canonicalInventory = await inventoryArtifact(canonical, {
-      integrity: { mode: "record-and-continue" },
+      integrity: "record-and-continue",
     });
     expect(selectedInventory.manifest.root_sha256).toBe(
       canonicalInventory.manifest.root_sha256,