@blamejs/core 0.15.13 → 0.15.15

package/lib/asn1-der.js

@@ -79,13 +79,25 @@ function readNode(buf, offset) {
     // High-tag-number form (multi-byte tag). Walk continuation octets
     // (each top bit set means another follows).
     tag = 0;
+    var tagOctets = 0;
     while (true) {
       if (offset + headerLen >= buf.length) {
         throw new Asn1Error("asn1/short", "tag continuation truncated");
       }
       var byte = buf[offset + headerLen];
+      if (tagOctets === 0 && byte === 0x80) {                                   // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/tag-non-minimal",
+          "high-tag-number form has a non-minimal leading 0x80 octet");
+      }
       headerLen += 1;
-      tag = (tag << 7) | (byte & 0x7f);                                         // base-128 tag bits
+      tagOctets += 1;
+      // Base-128 multiplication (NOT `tag << 7`, which coerces to 32-bit
+      // signed int and overflows to a negative/wrong tag past 2^28).
+      tag = (tag * 128) + (byte & 0x7f);
+      if (tag > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/tag-too-large",
+          "high-tag-number exceeds the safe-integer range");
+      }
       if ((byte & 0x80) === 0) break;                                           // continuation bit
     }
   }
@@ -161,29 +173,45 @@ function readOid(node) {
   if (bytes.length === 0) {
     throw new Asn1Error("asn1/oid-empty", "OID value is empty");
   }
-  // First two arcs are encoded as `40*X + Y`.
-  var first = Math.floor(bytes[0] / 40);                                        // OID encoding constant
-  var second = bytes[0] % 40;                                                   // OID encoding constant
-  // Per X.690, when first byte >= 80 the first arc is 2 and second is byte-80.
-  if (first > 2) { first = 2; second = bytes[0] - 80; }                         // OID encoding constant
-  var arcs = [String(first), String(second)];
-
-  var i = 1;
+  // Decode every subidentifier as a full base-128 quantity (X.690 §8.19),
+  // rejecting non-minimal leading-0x80 padding and unterminated/oversized
+  // arcs. The FIRST subidentifier may itself span continuation octets
+  // (§8.19.4); only after decoding it do we split into the first two arcs.
+  var subids = [];
+  var i = 0;
   while (i < bytes.length) {
     var arc = 0;
     var j = i;
+    var done = false;
     while (j < bytes.length) {
       var b = bytes[j];
+      if (j === i && b === 0x80) {                                              // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/oid-non-minimal",
+          "OID subidentifier has a non-minimal leading 0x80 octet");
+      }
       arc = (arc * 128) + (b & 0x7f);                                           // base-128 OID arc
+      if (arc > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/oid-overflow",
+          "OID subidentifier exceeds the safe-integer range");
+      }
       j += 1;
-      if ((b & 0x80) === 0) break;                                              // continuation bit
+      if ((b & 0x80) === 0) { done = true; break; }                            // continuation bit
     }
-    if (j === i) {
+    if (!done) {
       throw new Asn1Error("asn1/oid-malformed", "OID arc never terminated");
     }
-    arcs.push(String(arc));
+    subids.push(arc);
     i = j;
   }
+
+  // Split the first subidentifier into the first two arcs (40*X + Y).
+  var firstSubid = subids[0];
+  var first, second;
+  if (firstSubid < 40)      { first = 0; second = firstSubid; }
+  else if (firstSubid < 80) { first = 1; second = firstSubid - 40; }
+  else                      { first = 2; second = firstSubid - 80; }
+  var arcs = [String(first), String(second)];
+  for (var k = 1; k < subids.length; k += 1) arcs.push(String(subids[k]));
   return arcs.join(".");
 }
 
@@ -298,24 +326,44 @@ function writeInteger(buf) {
   return writeNode(TAG.INTEGER, buf);
 }
 
+// Append `arc` to `bytes` as a base-128 subidentifier (X.690 §8.19), most-
+// significant octet first, every octet but the last carrying the
+// continuation bit. Uses integer division (not 32-bit `>>> 7`) so arcs
+// beyond 2^31 encode correctly.
+function _writeBase128Subid(arc, bytes) {
+  if (arc === 0) { bytes.push(0); return; }
+  var stack = [];
+  while (arc > 0) {
+    stack.unshift(arc % 128);                                                    // base-128 digit
+    arc = Math.floor(arc / 128);
+  }
+  for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;                // continuation bit
+  for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
+}
+
 function writeOid(dotted) {
   // Encode dotted-decimal OID per X.690 §8.19.
   var parts = String(dotted).split(".").map(function (s) { return parseInt(s, 10); });
   if (parts.length < 2) {
     throw new Asn1Error("asn1/oid-too-short", "OID needs at least 2 arcs");
   }
-  var bytes = [parts[0] * 40 + parts[1]];                                        // OID first-arc encoding
-  for (var i = 2; i < parts.length; i += 1) {
-    var arc = parts[i];
-    if (arc === 0) { bytes.push(0); continue; }
-    var stack = [];
-    while (arc > 0) {
-      stack.unshift(arc & 0x7f);                                                 // base-128 mask
-      arc = arc >>> 7;                                                           // base-128 shift
+  for (var p = 0; p < parts.length; p += 1) {
+    if (!Number.isInteger(parts[p]) || parts[p] < 0 || parts[p] > Number.MAX_SAFE_INTEGER) {
+      throw new Asn1Error("asn1/oid-bad-arc", "OID arc " + p + " is not a non-negative integer");
     }
-    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;              // continuation bit
-    for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
   }
+  if (parts[0] > 2) {
+    throw new Asn1Error("asn1/oid-bad-arc", "OID first arc must be 0, 1, or 2");
+  }
+  if (parts[0] < 2 && parts[1] >= 40) {
+    throw new Asn1Error("asn1/oid-bad-arc",
+      "OID second arc must be < 40 when the first arc is 0 or 1");
+  }
+  var bytes = [];
+  // The first two arcs share one subidentifier (40*X + Y), which may itself
+  // need multiple base-128 octets (e.g. 2.999 -> 1079).
+  _writeBase128Subid(parts[0] * 40 + parts[1], bytes);
+  for (var i = 2; i < parts.length; i += 1) _writeBase128Subid(parts[i], bytes);
   return writeNode(TAG.OID, Buffer.from(bytes));
 }
 

package/lib/atomic-file.js

@@ -40,6 +40,8 @@
  */
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var nodeStream = require("node:stream");
+var streamPromises = require("node:stream/promises");
 var { generateToken, sha3Hash } = require("./crypto");
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -81,7 +83,11 @@ class AtomicFileError extends FrameworkError {
 // primitive's standard names; jitterFactor 0.5 reproduces the original
 // `delay * (0.5 + Math.random()/2)` range of [delay/2, delay].
 
-var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM"]);
+// EACCES joins the transient set: on Windows a freshly-written file is briefly
+// locked by AV / the search indexer / a file-sync client (Dropbox, OneDrive),
+// surfacing as EACCES (alongside EPERM/EBUSY) on the next open/rename — the same
+// transient contention the sync _renameWithRetry already treats as retryable.
+var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM", "EACCES"]);
 
 function _isFsRetryable(e) {
   return e != null && TRANSIENT_FS_ERRNOS.has(e.code);
@@ -485,6 +491,146 @@ function writeSync(filepath, data, opts) {
   };
 }
 
+/**
+ * @primitive b.atomicFile.writeStream
+ * @signature b.atomicFile.writeStream(filepath, source, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Streaming sibling of `writeSync` for payloads too large to buffer in
+ * memory. Pipes a Readable `source` into a sibling temp file opened with
+ * `O_EXCL | O_NOFOLLOW` (the same exclusive, symlink-refusing create
+ * every atomic write uses), fsyncs, then atomically renames over
+ * `filepath` and fsyncs the parent directory. A plain
+ * `fs.createWriteStream(filepath)` instead follows a symlink an attacker
+ * pre-planted at `filepath` (CWE-59 arbitrary write) and leaves a
+ * half-written object at the canonical name if the source aborts
+ * mid-stream — this primitive does neither: the file appears at
+ * `filepath` only after the full stream has landed and synced.
+ *
+ * Enforces a byte ceiling while streaming (`maxBytes`, default 64 MiB) so
+ * an unbounded source cannot fill the disk; the partial temp is removed
+ * on overflow or any pipeline error.
+ *
+ * @opts
+ *   fileMode:  0o600,            // mode applied to the temp file (and thus the renamed final)
+ *   maxBytes:  64 * 1024 * 1024, // refuse + clean up once the source exceeds this many bytes
+ *   signal:    undefined,        // optional AbortSignal forwarded to the pipeline
+ *
+ * @example
+ *   await b.atomicFile.writeStream(
+ *     "/var/lib/blamejs/object",
+ *     incomingRequestStream,
+ *     { fileMode: 0o600, maxBytes: b.C.BYTES.gib(2) }
+ *   );
+ *   // → { bytesWritten: 12345 }
+ */
+async function writeStream(filepath, source, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  if (!source || typeof source.pipe !== "function") {
+    throw new AtomicFileError(
+      "writeStream: source must be a Readable stream", "atomic-file/invalid-source");
+  }
+  var maxBytes = opts.maxBytes;
+
+  var dir = nodePath.dirname(filepath);
+  if (!nodeFs.existsSync(dir)) nodeFs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  var tmpPath = filepath + ".tmp-" + generateToken(C.BYTES.bytes(8));
+  var fd = _openExclTemp(tmpPath, opts.fileMode);
+  var fileStream = nodeFs.createWriteStream(null, { fd: fd, autoClose: false });
+  var bytesWritten = 0;
+  var renamed = false;
+
+  // Cap the stream as it flows — an unbounded source must not fill the disk.
+  var counter = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      bytesWritten += chunk.length;
+      if (typeof maxBytes === "number" && bytesWritten > maxBytes) {
+        return cb(new AtomicFileError(
+          "writeStream: source exceeds maxBytes " + maxBytes, "atomic-file/too-large"));
+      }
+      cb(null, chunk);
+    },
+  });
+
+  try {
+    if (opts.signal) {
+      await streamPromises.pipeline(source, counter, fileStream, { signal: opts.signal });
+    } else {
+      await streamPromises.pipeline(source, counter, fileStream);
+    }
+    _fsync(fd);
+    nodeFs.closeSync(fd);
+    fd = -1;
+    _renameWithRetry(tmpPath, filepath);
+    renamed = true;
+    _fsyncDir(dir);
+  } finally {
+    if (fd >= 0) { try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ } }
+    if (!renamed) {
+      // Source aborted, overflowed, or the rename failed — remove the temp so
+      // no half-written object survives at the canonical name.
+      try { nodeFs.unlinkSync(tmpPath); } catch (_e) { /* may not exist */ }
+    }
+  }
+
+  return { bytesWritten: bytesWritten };
+}
+
+/**
+ * @primitive b.atomicFile.writeExclSync
+ * @signature b.atomicFile.writeExclSync(filepath, data, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Exclusive, symlink-refusing write to `filepath` WITHOUT the atomic
+ * rename — for staged "write → fsync → verify → rename" flows where the
+ * caller must re-read and validate the written bytes before committing them
+ * over the live file (the vault seal/unseal round-trip re-reads the staged
+ * file and confirms it decrypts before renaming it into place). Clears any
+ * stale leftover at `filepath` first (an aborted prior run, or a planted
+ * symlink — `unlink` removes the LINK, never its target), then creates the
+ * file with `O_EXCL | O_NOFOLLOW`, so a symlink re-planted in the race
+ * window fails the open closed instead of being followed (CWE-59 / CWE-377).
+ * fsyncs the data before returning. For an ordinary write-and-replace use
+ * `writeSync`, which renames atomically; reach for this only when a
+ * verify-before-commit step sits between the write and the rename.
+ *
+ * @opts
+ *   fileMode: 0o600,   // mode applied to the created file
+ *
+ * @example
+ *   b.atomicFile.writeExclSync(stagingPath, bytes, { fileMode: 0o600 });
+ *   // re-read + verify stagingPath, then:
+ *   b.atomicFile.renameWithRetry(stagingPath, finalPath);
+ */
+function writeExclSync(filepath, data, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  var buf = safeBuffer.toBuffer(data, {
+    errorClass:  AtomicFileError,
+    typeCode:    "atomic-file/invalid-data",
+    typeMessage: "data must be Buffer, Uint8Array, or string",
+  });
+  // Clear any stale leftover so the exclusive create can proceed; unlink
+  // removes a planted symlink itself (not its target), and the O_EXCL open
+  // then fails closed if anything re-appears at the path in the race window.
+  try { nodeFs.unlinkSync(filepath); } catch (_e) { /* nothing to clear */ }
+  var fd = _openExclTemp(filepath, opts.fileMode);
+  try {
+    var pos = 0;
+    while (pos < buf.length) {
+      pos += nodeFs.writeSync(fd, buf, pos, buf.length - pos, null);
+    }
+    _fsync(fd);
+  } finally {
+    try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ }
+  }
+  return { bytesWritten: buf.length };
+}
+
 /**
  * @primitive b.atomicFile.cleanOrphans
  * @signature b.atomicFile.cleanOrphans(filepath, opts)
@@ -730,6 +876,7 @@ function _validateMaxBytes(maxBytes) {
  *   expectedHash:   string,    // SHA3-512 the content must match (default: none)
  *   encoding:       string,    // decode to a string (default: return a Buffer)
  *   allowShortRead: boolean,   // slice to the bytes read instead of throwing (default: false)
+ *   withStat:       boolean,   // return { bytes, stat } — stat of the bound fd (mode/uid/gid/size/ino/nlink/mtimeMs), TOCTOU-free
  *   errorFor:       Function,  // (kind, detail) => Error|undefined; kinds: enoent / symlink / too-large / toctou / short-read / integrity
  *
  * @example
@@ -737,6 +884,11 @@ function _validateMaxBytes(maxBytes) {
  *     maxBytes: b.constants.BYTES.mib(1),
  *     encoding: "utf8",
  *   });
+ *
+ *   // Assert mode + owner on the exact inode the bytes came from (no re-stat):
+ *   var r = b.atomicFile.fdSafeReadSync("/etc/app/secret", { withStat: true });
+ *   if ((r.stat.mode & 0o077) !== 0) throw new Error("secret is group/other-readable");
+ *   // r.bytes is the Buffer (or string under `encoding`)
  */
 function fdSafeReadSync(filepath, opts) {
   opts = opts || {};
@@ -806,7 +958,26 @@ function fdSafeReadSync(filepath, opts) {
       throw errorFor("integrity", { expected: opts.expectedHash, actual: actual });
     }
   }
-  return opts.encoding ? buf.toString(opts.encoding) : buf;
+  var content = opts.encoding ? buf.toString(opts.encoding) : buf;
+  // withStat: return the fstat of the SAME bound fd alongside the bytes, so a
+  // caller that needs the mode / owner (e.g. to assert 0o600 + owned-by-me on a
+  // secrets file) reads it TOCTOU-free — the stat describes the exact inode the
+  // bytes came from, not a re-stat that an attacker could swap underneath.
+  if (opts.withStat) {
+    return {
+      bytes: content,
+      stat: {
+        mode:    fstat.mode,
+        uid:     fstat.uid,
+        gid:     fstat.gid,
+        size:    fstat.size,
+        ino:     fstat.ino,
+        nlink:   fstat.nlink,
+        mtimeMs: fstat.mtimeMs,
+      },
+    };
+  }
+  return content;
 }
 
 // Atomic-file's own reads route through fdSafeReadSync with an errorFor
@@ -1137,12 +1308,43 @@ function listDir(dir, opts) {
   return out;
 }
 
+/**
+ * @primitive b.atomicFile.openNoFollowSync
+ * @signature b.atomicFile.openNoFollowSync(filepath, mode?)
+ * @since      0.15.14
+ * @status     stable
+ * @related    b.atomicFile.fdSafeReadSync, b.atomicFile.readSync
+ *
+ * Open a path read-only with `O_NOFOLLOW` so a symlink at the final path
+ * component is refused (`ELOOP`) instead of followed — the streaming-read
+ * counterpart to `fdSafeReadSync` for callers that must `fs.createReadStream`
+ * (range serving, SRI/ETag hashing, large-object download) and cannot buffer
+ * the whole file. Stream from the returned fd: `fs.createReadStream(path, { fd
+ * })`. Defends a post-confinement symlink swap (CWE-22 / CWE-367) on
+ * request-reachable static-serve and object-store read paths, where a lexical
+ * `_assertInsideRoot` check alone leaves a swap window between the check and the
+ * open. `O_NOFOLLOW` is POSIX-only; on platforms without it the flag is 0 (a
+ * plain `O_RDONLY` open) — Windows symlink semantics differ and are out of
+ * scope. Throws the raw `openSync` error (caller maps `ELOOP` / `ENOENT`).
+ *
+ * @example
+ *   var fd = b.atomicFile.openNoFollowSync(absPath);
+ *   var stream = fs.createReadStream(absPath, { fd: fd });   // autoClose closes fd
+ */
+function openNoFollowSync(filepath, mode) {
+  var flags = nodeFs.constants.O_RDONLY | (nodeFs.constants.O_NOFOLLOW || 0);
+  return nodeFs.openSync(filepath, flags, mode === undefined ? 0o600 : mode);
+}
+
 module.exports = {
   write:             write,
   writeSync:         writeSync,
+  writeStream:       writeStream,
+  writeExclSync:     writeExclSync,
   read:              read,
   readSync:          readSync,
   fdSafeReadSync:    fdSafeReadSync,
+  openNoFollowSync:  openNoFollowSync,
   writeJson:         writeJson,
   readJson:          readJson,
   copy:              copy,

package/lib/audit-chain.js

@@ -39,6 +39,7 @@ var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
 var safeSql = require("./safe-sql");
+var safeBuffer = require("./safe-buffer");
 var { sha3Hash } = require("./crypto");
 
 // b.sql opts for the chain read SQL these primitives compose. The reader
@@ -219,6 +220,8 @@ async function getChainTip(queryOneAsync, tableName, opts) {
  *   maxRows:   number,   // stop after N rows per (sub-)chain (default: walk every row)
  *   chainKey:  string,   // partition column — verify each sub-chain independently
  *   maxChains: number,   // max partitions to verify under chainKey (default 100000; fails closed)
+ *   from:      number,   // single-chain only: verify rows with monotonicCounter >= from, anchored at the predecessor's rowHash (incremental verify after a known-good checkpoint)
+ *   to:        number,   // single-chain only: verify rows with monotonicCounter <= to
  *
  * @example
  *   async function queryAll(sql) { return await myDriver.query(sql); }
@@ -275,7 +278,12 @@ function _walkRows(rows, tableName, startPrevHash, opts) {
 
     if (opts.maxRows && i >= opts.maxRows - 1) break;
   }
-  return { ok: true, table: tableName, rowsVerified: rows.length, lastHash: prevHash };
+  // Report the count ACTUALLY walked, not rows.length — under maxRows the walk
+  // stops early, so rows.length would over-report coverage (a caller reading
+  // rowsVerified to judge how much of the chain was checked must see the real
+  // number, not be told the whole table verified when only maxRows did).
+  var verifiedCount = opts.maxRows ? Math.min(rows.length, opts.maxRows) : rows.length;
+  return { ok: true, table: tableName, rowsVerified: verifiedCount, lastHash: prevHash };
 }
 
 async function verifyChain(queryAllAsync, tableName, opts) {
@@ -349,11 +357,30 @@ async function verifyChain(queryAllAsync, tableName, opts) {
       anchor = [];
     }
     if (Array.isArray(anchor) && anchor.length > 0) {
-      prevHash = anchor[0].lastPurgedRowHash;
-      skipBeforeCounter = Number(anchor[0].lastPurgedCounter);
+      var aHash = anchor[0].lastPurgedRowHash;
+      var aCounter = Number(anchor[0].lastPurgedCounter);
+      // A corrupted / tampered purge anchor (non-hex lastPurgedRowHash or a
+      // non-numeric lastPurgedCounter) must fail CLOSED with a clear reason.
+      // Passing a garbage prevHash into _walkRows → computeRowHash would THROW
+      // ("prevHash must be a 128-char hex"), turning a defensive verify into an
+      // uncaught exception; a NaN counter would skip nothing and surface as an
+      // opaque chain-break. Detect it here and return { ok:false }.
+      if (!safeBuffer.isHex(aHash, SHA3_512_HEX_LEN) || !isFinite(aCounter) || aCounter < 0) {
+        return { ok: false, table: tableName, rowsVerified: 0, reason: "corrupted purge anchor" };
+      }
+      prevHash = aHash;
+      skipBeforeCounter = aCounter;
     }
   }
 
+  // Incremental verify (b.audit.verify { from, to }): verify only rows whose
+  // monotonicCounter is in [from, to]. `from` must anchor on the rowHash of the
+  // row immediately BEFORE it, so the scoped walk chains correctly — otherwise
+  // the first in-range row's prevHash (= the predecessor's rowHash) wouldn't
+  // match ZERO_HASH and a good chain would falsely report a break.
+  var fromCounter = (opts.from != null && isFinite(Number(opts.from))) ? Number(opts.from) : null;
+  var toCounter   = (opts.to != null && isFinite(Number(opts.to)))   ? Number(opts.to)   : null;
+
   var rowsBuilt = sql.select(tableName, _sqlOpts())
     .orderBy("monotonicCounter", "asc")
     .toSql();
@@ -364,9 +391,31 @@ async function verifyChain(queryAllAsync, tableName, opts) {
   // verified on SQLite without this. coerceRow makes the recompute
   // type-stable across backends (no-op on already-numeric SQLite rows).
   rows = frameworkSchema.coerceRows(rows);
-  if (skipBeforeCounter > 0) {
+
+  // Resolve the incremental-verify anchor: the highest row strictly below
+  // `from` (derived from the already-read rows, no extra query). Raise
+  // skipBeforeCounter to it and adopt its rowHash as the chain anchor.
+  if (fromCounter != null && fromCounter > skipBeforeCounter + 1) {
+    var pred = null;
+    for (var pi = 0; pi < rows.length; pi++) {
+      var pc = Number(rows[pi].monotonicCounter);
+      if (pc < fromCounter && pc > skipBeforeCounter) pred = rows[pi]; else if (pc >= fromCounter) break;
+    }
+    if (pred) {
+      if (!safeBuffer.isHex(pred.rowHash, SHA3_512_HEX_LEN)) {
+        return { ok: false, table: tableName, rowsVerified: 0, reason: "incremental-verify anchor row has a corrupt rowHash" };
+      }
+      prevHash = pred.rowHash;
+      skipBeforeCounter = Math.max(skipBeforeCounter, Number(pred.monotonicCounter));
+    }
+  }
+
+  if (skipBeforeCounter > 0 || toCounter != null) {
     rows = rows.filter(function (r) {
-      return Number(r.monotonicCounter) > skipBeforeCounter;
+      var c = Number(r.monotonicCounter);
+      if (c <= skipBeforeCounter) return false;
+      if (toCounter != null && c > toCounter) return false;
+      return true;
     });
   }
 

package/lib/audit-daily-review.js

@@ -83,9 +83,15 @@ function _defaultClassify(event) {
 }
 
 function _severityAtLeast(severity, threshold) {
-  var sIdx = SEVERITY_ORDER.indexOf(severity);
   var tIdx = SEVERITY_ORDER.indexOf(threshold);
-  if (sIdx === -1 || tIdx === -1) return false;
+  if (tIdx === -1) return false;   // unknown threshold (validated at config)
+  var sIdx = SEVERITY_ORDER.indexOf(severity);
+  // An UNKNOWN event severity — e.g. a custom classify(event) returning an
+  // unexpected value — must NOT silently drop the event from the review. Fail
+  // SAFE: treat it as meeting the threshold so the operator still sees the
+  // event (and notices their classify mis-returned) rather than missing a
+  // flagged event.
+  if (sIdx === -1) return true;
   return sIdx >= tIdx;
 }
 
@@ -247,6 +253,10 @@ function create(opts) {
         from:  fromMs,
         to:    startedAt,
         limit: queryLimit,
+        // Newest-first: if the window holds more than queryLimit events, keep
+        // the MOST RECENT (the actionable ones) — an ascending+limit query would
+        // keep the oldest and silently drop the newest from the review.
+        order: "desc",
       });
     } catch (e) {
       _emit("audit.daily_review.failed", {

package/lib/audit-sign.js

@@ -59,6 +59,7 @@
  *   SLH-DSA-SHAKE-256f post-quantum signature for audit-chain checkpoints.
  */
 var nodeFs = require("node:fs");
+var numericBounds = require("./numeric-bounds");
 var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
@@ -835,7 +836,7 @@ function _normalizeTip(tip, fnLabel) {
       "auditSign." + fnLabel + ": tip must be an object { counter, tipHash }");
   }
   var counter = tip.counter;
-  if (typeof counter !== "number" || !isFinite(counter) || counter < 0 || Math.floor(counter) !== counter) {
+  if (!numericBounds.isNonNegativeFiniteInt(counter)) {
     throw _err("ANCHOR_BAD_COUNTER",
       "auditSign." + fnLabel + ": tip.counter must be a non-negative integer (got: " + counter + ")");
   }