ArtifactSignal

Defined in: types.ts:187

Properties

Property	Type	Description	Defined in
digest	string	Canonical digest of the bytes targate actually inspected.	types.ts:190
historicalIntegrity?	string	-	types.ts:196
lockfileIntegrity?	string	-	types.ts:194
metadataDrift?	string[]	Registry-metadata vs tarball-manifest divergences that are NOT byte tampering: the artifact bytes are independently checksum-verified, so the tarball is authentic and authoritative, but its package.json disagrees with the registry packument on a field npm can legitimately normalize (e.g. lifecycle scripts). Surfaced as an approvable require_approval reason rather than a mutated hard block. Identity fields (name/version) and the dependency graph stay hard blocks — they define the artifact.	types.ts:208
publicIntegrity?	string	-	types.ts:195
publicRegistryUrl?	string	-	types.ts:197
reasons	string[]	-	types.ts:198
registryIntegrity?	string	-	types.ts:193
registryUrl	string	-	types.ts:191
tarballUrl	string	-	types.ts:192
trust	ArtifactTrust	-	types.ts:188