@blamejs/blamejs-shop 0.4.87 → 0.4.89

package/lib/vendor/blamejs/test/layer-0-primitives/dpop-htu-peergating.test.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * DPoP htu reconstruction must peer-gate X-Forwarded-Proto / X-Forwarded-Host
+ * (RFC 9449 §4.3). The htu (scheme + authority + path) is cryptographically
+ * bound in the proof, so if the server builds it from a forgeable forwarded
+ * header trusted from ANY caller, a direct attacker can forge
+ * X-Forwarded-Proto: https / a victim X-Forwarded-Host and make a proof signed
+ * for one origin validate against another (htu confusion).
+ *
+ * dpop previously honored both via a bare boolean opts.trustForwardedHeaders,
+ * which trusted the headers with no immediate-peer check — the same forgeable
+ * class csrf-protect / security-headers / cors already closed via the
+ * peer-gated requestHelpers resolvers. This brings dpop onto the same
+ * fail-closed model: trustForwardedHeaders is refused on its own, and proto +
+ * host resolve through b.requestHelpers.trustedProtocol / trustedHost, honoring
+ * the forwarded headers only from a declared trusted-proxy peer.
+ *
+ * Covers the two new peer-gated primitives (requestHost / trustedHost), the
+ * dpop create()-time refusal, and the end-to-end htu decision.
+ *
+ * Run standalone: node test/layer-0-primitives/dpop-htu-peergating.test.js
+ */
+
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _ns() { return b.nonceStore.create({ backend: "memory" }); }
+
+function _mkRes() {
+  var res = {
+    statusCode: 200, headersSent: false, _status: null, _body: null, _ended: false,
+    writeHead: function (s) { res._status = s; res.statusCode = s; res.headersSent = true; return res; },
+    setHeader: function () {},
+    getHeader: function () { return undefined; },
+    end: function (bdy) { res._ended = true; if (bdy != null) res._body = bdy; },
+    json: function (o) { res._status = res._status || res.statusCode; res._body = JSON.stringify(o); res._ended = true; },
+  };
+  return res;
+}
+
+// ---- requestHost / trustedHost primitives ----
+
+function testRequestHostPrimitive() {
+  var base = {
+    headers: { host: "real.example.com", "x-forwarded-host": "forged.evil.test" },
+    socket: { remoteAddress: "203.0.113.9", encrypted: false },
+  };
+
+  // default (no trustProxy): the forwarded header is ignored, the request's own
+  // Host is returned.
+  check("requestHost: default ignores X-Forwarded-Host, uses Host",
+        b.requestHelpers.requestHost(base) === "real.example.com");
+  check("requestHost: default with trustProxy:false ignores forwarded",
+        b.requestHelpers.requestHost(base, { trustProxy: false }) === "real.example.com");
+
+  // peer-gated predicate: peer NOT trusted → forged header ignored.
+  var notTrusted = function (addr) { return addr === "10.0.0.1"; };
+  check("requestHost: predicate ignores X-Forwarded-Host from an untrusted peer",
+        b.requestHelpers.requestHost(base, { trustProxy: notTrusted }) === "real.example.com");
+
+  // peer-gated predicate: peer trusted → forwarded header honored.
+  var trusted = function (addr) { return addr === "203.0.113.9"; };
+  check("requestHost: predicate honors X-Forwarded-Host from a trusted peer",
+        b.requestHelpers.requestHost(base, { trustProxy: trusted }) === "forged.evil.test");
+
+  // legacy true: honored unconditionally (spoofable — documented).
+  check("requestHost: legacy true honors forwarded (leftmost hop)",
+        b.requestHelpers.requestHost(base, { trustProxy: true }) === "forged.evil.test");
+
+  // absent host → null.
+  check("requestHost: returns null when no host present",
+        b.requestHelpers.requestHost({ headers: {} }) === null);
+}
+
+function testTrustedHostPrimitive() {
+  var base = {
+    headers: { host: "real.example.com", "x-forwarded-host": "forged.evil.test" },
+    socket: { remoteAddress: "203.0.113.9", encrypted: false },
+  };
+
+  // No options → not peer-gated, forwarded ignored.
+  var plain = b.requestHelpers.trustedHost();
+  check("trustedHost: no opts is not peerGated", plain.peerGated === false);
+  check("trustedHost: no opts ignores X-Forwarded-Host", plain.resolve(base) === "real.example.com");
+
+  // trustedProxies covering the peer → peer-gated, forwarded honored.
+  var gated = b.requestHelpers.trustedHost({ trustedProxies: ["203.0.113.0/24"] });
+  check("trustedHost: trustedProxies is peerGated", gated.peerGated === true);
+  check("trustedHost: honors X-Forwarded-Host from a trusted-proxy peer",
+        gated.resolve(base) === "forged.evil.test");
+
+  // trustedProxies NOT covering the peer → forged header ignored.
+  var gatedMiss = b.requestHelpers.trustedHost({ trustedProxies: ["10.0.0.0/8"] });
+  check("trustedHost: ignores X-Forwarded-Host from a non-trusted peer",
+        gatedMiss.resolve(base) === "real.example.com");
+
+  // hostResolver lets the operator own it.
+  var owned = b.requestHelpers.trustedHost({ hostResolver: function () { return "owned.example.com"; } });
+  check("trustedHost: hostResolver is peerGated", owned.peerGated === true);
+  check("trustedHost: hostResolver owns the value", owned.resolve(base) === "owned.example.com");
+
+  // bad hostResolver → TypeError at construction.
+  var threw = null;
+  try { b.requestHelpers.trustedHost({ hostResolver: 123 }); } catch (e) { threw = e; }
+  check("trustedHost: non-function hostResolver throws", threw instanceof TypeError);
+}
+
+// ---- dpop create()-time refusal of the spoofable legacy boolean ----
+
+function testDpopRefusesBareTrustForwardedHeaders() {
+  var threw = null;
+  try {
+    b.middleware.dpop({ replayStore: _ns(), trustForwardedHeaders: true });
+  } catch (e) { threw = e; }
+  check("dpop: bare trustForwardedHeaders:true is refused at create()", threw !== null);
+  check("dpop: refusal names the spoofable risk + trustedProxies migration",
+        threw && /spoofable|trustedProxies/i.test(String(threw.message || threw)));
+
+  // WITH trustedProxies it mounts (the operator declared the trust edge).
+  var ok = null;
+  try {
+    ok = b.middleware.dpop({ replayStore: _ns(), trustForwardedHeaders: true, trustedProxies: ["10.0.0.0/8"] });
+  } catch (e) { ok = e; }
+  check("dpop: trustForwardedHeaders:true WITH trustedProxies mounts", typeof ok === "function");
+
+  // Default (no forwarded trust) mounts cleanly.
+  var def = null;
+  try { def = b.middleware.dpop({ replayStore: _ns() }); } catch (e) { def = e; }
+  check("dpop: default (no forwarded trust) mounts", typeof def === "function");
+
+  // getHtu owns the entire URI → _reconstructHtu (and the forwarded headers) is
+  // never consulted, so a leftover trustForwardedHeaders:true is moot and must
+  // NOT fail construction (the refusal only matters when htu is reconstructed).
+  var withGetHtu = null;
+  try {
+    withGetHtu = b.middleware.dpop({
+      replayStore: _ns(),
+      trustForwardedHeaders: true,
+      getHtu: function () { return "https://api.example.com/resource"; },
+    });
+  } catch (e) { withGetHtu = e; }
+  check("dpop: trustForwardedHeaders:true WITH getHtu mounts (reconstruction bypassed)",
+        typeof withGetHtu === "function");
+}
+
+// ---- end-to-end: a forged X-Forwarded-Proto/Host from a non-trusted peer
+//      must NOT be used to reconstruct the htu (the bound proof is rejected);
+//      from a trusted-proxy peer it IS honored. ----
+
+async function _proofForHttps(key) {
+  return b.auth.dpop.buildProof({
+    htm: "POST",
+    htu: "https://api.example.com/resource",
+    privateKey: key,
+    algorithm: "ES256",
+  });
+}
+
+function _forgedReq(proof) {
+  return {
+    method: "POST",
+    url: "/resource",
+    headers: {
+      host: "api.example.com",
+      "x-forwarded-proto": "https",
+      "x-forwarded-host": "api.example.com",
+      dpop: proof,
+    },
+    socket: { remoteAddress: "203.0.113.9", encrypted: false },   // plain HTTP from a direct caller
+  };
+}
+
+async function testForgedForwardedNotHonored() {
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var keyPem = kp.privateKey.export({ type: "pkcs8", format: "pem" });
+
+  // Peer 203.0.113.9 is NOT in trustedProxies (10.0.0.0/8) → forged
+  // X-Forwarded-Proto:https is ignored → htu reconstructed as http://… →
+  // the proof signed for https://api.example.com/resource MUST be rejected.
+  var mw = b.middleware.dpop({ replayStore: _ns(), trustedProxies: ["10.0.0.0/8"] });
+  var proof = await _proofForHttps(keyPem);
+  var req = _forgedReq(proof);
+  var res = _mkRes();
+  var nextCalled = false;
+  await mw(req, res, function () { nextCalled = true; });
+  check("forged XFP from untrusted peer: htu stays http → proof rejected (401)",
+        res._status === 401 && nextCalled === false);
+  check("forged XFP from untrusted peer: handler not reached", req.dpop === undefined);
+}
+
+async function testTrustedPeerForwardedHonored() {
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var keyPem = kp.privateKey.export({ type: "pkcs8", format: "pem" });
+
+  // Peer 203.0.113.9 IS in trustedProxies (203.0.113.0/24) → X-Forwarded-Proto
+  // :https + X-Forwarded-Host honored → htu = https://api.example.com/resource
+  // matches the proof → it verifies and the request proceeds.
+  var mw = b.middleware.dpop({ replayStore: _ns(), trustedProxies: ["203.0.113.0/24"] });
+  var proof = await _proofForHttps(keyPem);
+  var req = _forgedReq(proof);
+  var res = _mkRes();
+  var nextCalled = false;
+  await mw(req, res, function () { nextCalled = true; });
+  check("trusted-proxy peer: XFP honored → htu https → proof verifies (next called)",
+        nextCalled === true && res._status !== 401);
+  check("trusted-proxy peer: req.dpop attached for downstream binding",
+        req.dpop && typeof req.dpop.jkt === "string");
+}
+
+async function run() {
+  testRequestHostPrimitive();
+  testTrustedHostPrimitive();
+  testDpopRefusesBareTrustForwardedHeaders();
+  await testForgedForwardedNotHonored();
+  await testTrustedPeerForwardedHonored();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/queue-flow-repeat.test.js

@@ -300,7 +300,90 @@ async function testEnqueueRoundTripsAvailableAt() {
   }
 }
 
+// R7-4: a deps-bearing flow child must be PARKED (non-leaseable) from the
+// instant it is enqueued. enqueueFlow's first pass now passes dependsOn so
+// queue-local parks the child at FLOW_BLOCKED immediately, instead of leaving
+// it leaseable until the second pass — a window in which a concurrent consumer
+// could lease it before its dependencies have run. Driven on the real
+// queue-local consumer (enqueue → lease), distinguishing jobs by returned id.
+async function testFlowChildParkedAtEnqueue() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var queueLocal = require("../../lib/queue-local");
+    var ql = queueLocal.create();   // default store (framework db, single-node)
+
+    var childEnq = await ql.enqueue("park-q", { n: "child" },
+      { dependsOn: ["dep-a"], flowId: "f1", flowChildName: "child" });
+    var rootEnq = await ql.enqueue("park-q", { n: "root" },
+      { flowId: "f1", flowChildName: "root" });
+    var leased = await ql.lease("park-q", 30000, 10);
+    var leasedIds = leased.map(function (j) { return j.jobId; });
+    check("R7-4: a root (no-deps) child is immediately leaseable",
+          leasedIds.indexOf(rootEnq.jobId) !== -1);
+    check("R7-4: a deps-bearing child is PARKED (not leased) at enqueue time",
+          leasedIds.indexOf(childEnq.jobId) === -1);
+
+    // Contrast: WITHOUT dependsOn at enqueue (the pre-fix first-pass shape) the
+    // same child WOULD be leaseable — proving the parking is what closes the
+    // race, not some other gate.
+    var unparkedEnq = await ql.enqueue("park-q2", { n: "unparked" },
+      { flowId: "f2", flowChildName: "unparked" });
+    var leased2 = await ql.lease("park-q2", 30000, 10);
+    check("R7-4 contrast: a child enqueued WITHOUT dependsOn is leaseable",
+          leased2.map(function (j) { return j.jobId; }).indexOf(unparkedEnq.jobId) !== -1);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// P1: if a dependency completes in the WINDOW between enqueueFlow's first
+// pass (which enqueues + parks the deps-bearing child) and its second pass
+// (patchFlowDeps, which resolves dependency NAMES → sibling jobIds), the
+// completion has already released the child (complete() →
+// _maybeReleaseFlowChildren bumps availableAt to now). patchFlowDeps must
+// NOT re-park it: the dependency is done and never completes again, so a
+// re-park would strand the child pending-but-unleaseable forever. Driven on
+// the real queue-local consumer: enqueue (parked) → complete the dep (the
+// in-window release) → patchFlowDeps → the child MUST still be leaseable.
+async function testPatchFlowDepsDoesNotReparkReleasedChild() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var queueLocal = require("../../lib/queue-local");
+    var ql = queueLocal.create();
+
+    // First-pass shape: a no-deps dependency + a deps-bearing child parked by
+    // its dependsOn (the dependency NAMES the first pass writes).
+    var depEnq = await ql.enqueue("win-q", { n: "dep" },
+      { flowId: "fw", flowChildName: "dep-a" });
+    var childEnq = await ql.enqueue("win-q", { n: "child" },
+      { dependsOn: ["dep-a"], flowId: "fw", flowChildName: "child" });
+
+    // The dependency completes BEFORE the second pass — releasing the child.
+    var leasedDep = await ql.lease("win-q", 30000, 10);
+    var leasedDepIds = leasedDep.map(function (j) { return j.jobId; });
+    check("window: the dependency leased while the child is still parked",
+          leasedDepIds.indexOf(depEnq.jobId) !== -1 &&
+          leasedDepIds.indexOf(childEnq.jobId) === -1);
+    await ql.complete(depEnq.jobId);   // → _maybeReleaseFlowChildren releases the child
+
+    // Second pass runs AFTER the in-window release.
+    await ql.patchFlowDeps(childEnq.jobId, [depEnq.jobId]);
+
+    // The child must still be leaseable. On the pre-fix tree patchFlowDeps
+    // re-parked availableAt at MAX_SAFE_INTEGER, stranding it forever.
+    var leasedChild = await ql.lease("win-q", 30000, 10);
+    check("P1: a child released in the enqueue window is NOT re-parked by patchFlowDeps",
+          leasedChild.map(function (j) { return j.jobId; }).indexOf(childEnq.jobId) !== -1);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
+  await testFlowChildParkedAtEnqueue();
+  await testPatchFlowDepsDoesNotReparkReleasedChild();
   await testFlowSurface();
   await testRepeatCronReEnqueuesAfterComplete();
   await testRepeatStopsOnFinalFailure();

package/lib/vendor/blamejs/test/layer-0-primitives/self-update-poll-asset-digest.test.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * b.selfUpdate.poll — the GitHub release asset `digest` field must reach
+ * the returned asset object.
+ *
+ * The GitHub releases API includes `assets[].digest` (e.g.
+ * "sha256:<hex>") on each asset. poll() returned each matched asset as
+ * { name, url, size } and dropped digest, so a consumer could not do a
+ * defense-in-depth in-flight integrity check against the release-
+ * published digest. This drives the real b.selfUpdate.poll consumer
+ * path against a local http.Server fixture (no live GitHub) and asserts
+ * the returned asset / signature objects expose `digest`.
+ *
+ * Run standalone: `node test/layer-0-primitives/self-update-poll-asset-digest.test.js`
+ */
+
+var http    = require("http");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _serveJson(payload) {
+  return http.createServer(function (req, res) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(payload));
+  });
+}
+
+var ASSET_DIGEST = "sha256:1111111111111111111111111111111111111111111111111111111111111111";
+var SIG_DIGEST   = "sha256:2222222222222222222222222222222222222222222222222222222222222222";
+
+async function testPollExposesAssetDigest() {
+  var server = _serveJson({
+    tag_name: "v2.0.0",
+    assets: [
+      { name: "blamejs-2.0.0.tar.gz",     browser_download_url: "https://example.invalid/asset.tgz", size: 1024, digest: ASSET_DIGEST },
+      { name: "blamejs-2.0.0.tar.gz.sig", browser_download_url: "https://example.invalid/asset.sig", size: 64,   digest: SIG_DIGEST },
+    ],
+  });
+  var port = await b.testing.listenOnRandomPort(server);
+  try {
+    var r = await b.selfUpdate.poll({
+      releasesUrl:      "http://127.0.0.1:" + port + "/releases/latest",
+      currentVersion:   "v1.0.0",
+      allowedProtocols: ["http:"],
+      allowInternal:    true,
+    });
+    check("poll: available=true",          r.available === true);
+    check("poll: asset selected",          r.asset && r.asset.name === "blamejs-2.0.0.tar.gz");
+    check("poll: asset.digest exposed",     r.asset && r.asset.digest === ASSET_DIGEST);
+    check("poll: signature selected",      r.signature && r.signature.name === "blamejs-2.0.0.tar.gz.sig");
+    check("poll: signature.digest exposed", r.signature && r.signature.digest === SIG_DIGEST);
+  } finally { server.close(); }
+}
+
+async function testPollDigestNullWhenAbsent() {
+  // Upstream omits digest — the returned object must expose digest: null
+  // (the field is present, defense-in-depth check is skipped).
+  var server = _serveJson({
+    tag_name: "v2.0.0",
+    assets: [
+      { name: "blamejs-2.0.0.tar.gz", browser_download_url: "https://example.invalid/asset.tgz", size: 1024 },
+    ],
+  });
+  var port = await b.testing.listenOnRandomPort(server);
+  try {
+    var r = await b.selfUpdate.poll({
+      releasesUrl:      "http://127.0.0.1:" + port + "/releases/latest",
+      currentVersion:   "v1.0.0",
+      allowedProtocols: ["http:"],
+      allowInternal:    true,
+    });
+    check("poll: asset selected (no digest upstream)", r.asset && r.asset.name === "blamejs-2.0.0.tar.gz");
+    check("poll: asset.digest is null when absent",    r.asset && r.asset.digest === null);
+  } finally { server.close(); }
+}
+
+async function run() {
+  await testPollExposesAssetDigest();
+  await testPollDigestNullWhenAbsent();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/self-update-standalone-verifier-ecdsa-encoding.test.js

@@ -0,0 +1,274 @@
+"use strict";
+/**
+ * b.selfUpdate.standaloneVerifier — ECDSA signature-encoding dispatch.
+ *
+ * The standalone verifier must choose the ECDSA signature encoding
+ * (DER ASN.1 SEQUENCE vs IEEE-P1363 raw r||s) by STRUCTURE, not by
+ * byte length. A P-384 DER signature whose r and s both encode short
+ * can total exactly 96 bytes — the same length as a raw P-384 sig — so
+ * a length-only heuristic mis-decodes the valid DER signature as raw
+ * and spuriously rejects an otherwise-valid update.
+ *
+ * RED before the fix: a forged-but-genuine 96-byte DER P-384 signature
+ * verifies as DER yet is rejected by the length-based dispatch.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+var nc = require("node:crypto");
+
+// ---------------------------------------------------------------------------
+// Minimal P-384 (secp384r1) math, BigInt-only (no deps), used solely to
+// FORGE a valid signature with chosen short coordinates so its DER form is
+// exactly 96 bytes. A genuine 96-byte DER P-384 signature is astronomically
+// rare from random signing (coordinates are ~48 bytes), so we construct one:
+// given chosen (r, s) and the message hash e, we solve for a public key Q
+// such that (r, s) is a valid ECDSA signature — Q = r^-1 (s*R - e*G), where
+// R is a curve point with x-coordinate r. The resulting (asset, sig, pubkey)
+// triple verifies as DER under node:crypto.
+// ---------------------------------------------------------------------------
+var P_P  = BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff");
+var P_A  = P_P - 3n;
+var P_B  = BigInt("0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef");
+var P_N  = BigInt("0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973");
+var P_GX = BigInt("0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7");
+var P_GY = BigInt("0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f");
+var P_G  = [P_GX, P_GY];
+
+function _mod(x, m) { var r = x % m; return r < 0n ? r + m : r; }
+function _modpow(base, exp, m) {
+  base = _mod(base, m);
+  var r = 1n;
+  while (exp > 0n) { if (exp & 1n) r = _mod(r * base, m); base = _mod(base * base, m); exp >>= 1n; }
+  return r;
+}
+function _inv(x, m) { return _modpow(_mod(x, m), m - 2n, m); }
+function _double(pt) {
+  if (pt === null) return null;
+  var x = pt[0], y = pt[1];
+  if (y === 0n) return null;
+  var s = _mod((3n * x * x + P_A) * _inv(2n * y, P_P), P_P);
+  var xr = _mod(s * s - 2n * x, P_P);
+  var yr = _mod(s * (x - xr) - y, P_P);
+  return [xr, yr];
+}
+function _add(pt1, pt2) {
+  if (pt1 === null) return pt2;
+  if (pt2 === null) return pt1;
+  var x1 = pt1[0], y1 = pt1[1], x2 = pt2[0], y2 = pt2[1];
+  if (x1 === x2) { if (_mod(y1 + y2, P_P) === 0n) return null; return _double(pt1); }
+  var s = _mod((y2 - y1) * _inv(x2 - x1, P_P), P_P);
+  var xr = _mod(s * s - x1 - x2, P_P);
+  var yr = _mod(s * (x1 - xr) - y1, P_P);
+  return [xr, yr];
+}
+function _neg(pt) { return pt === null ? null : [pt[0], _mod(-pt[1], P_P)]; }
+function _scalarMul(k, pt) {
+  k = _mod(k, P_N);
+  var r = null, q = pt;
+  while (k > 0n) { if (k & 1n) r = _add(r, q); q = _double(q); k >>= 1n; }
+  return r;
+}
+function _liftX(xr) {
+  var rhs = _mod(xr * xr * xr + P_A * xr + P_B, P_P);
+  var y = _modpow(rhs, (P_P + 1n) / 4n, P_P);   // p % 4 === 3
+  if (_mod(y * y, P_P) !== rhs) return null;
+  return [xr, y];
+}
+function _beToBig(buf) { var x = 0n; for (var i = 0; i < buf.length; i++) x = (x << 8n) | BigInt(buf[i]); return x; }
+function _bigToFixed(x, len) {
+  var h = x.toString(16);
+  if (h.length < len * 2) h = "0".repeat(len * 2 - h.length) + h;
+  return Buffer.from(h, "hex");
+}
+function _derInt(x) {
+  var h = x.toString(16);
+  if (h.length % 2) h = "0" + h;
+  var bts = Buffer.from(h, "hex");
+  var i = 0;
+  while (i < bts.length - 1 && bts[i] === 0) i++;
+  bts = bts.subarray(i);
+  if (bts[0] & 0x80) bts = Buffer.concat([Buffer.from([0]), bts]);
+  return Buffer.concat([Buffer.from([0x02, bts.length]), bts]);
+}
+function _derSig(r, s) {
+  var body = Buffer.concat([_derInt(r), _derInt(s)]);
+  return Buffer.concat([Buffer.from([0x30, body.length]), body]);
+}
+// SPKI DER prefix for an EC P-384 public key (the fixed ASN.1 header that
+// precedes the 97-byte uncompressed point 0x04 || X || Y).
+var _EC_P384_SPKI_PREFIX = Buffer.from("3076301006072a8648ce3d020106052b81040022036200", "hex");
+function _pubKeyFromPoint(pt) {
+  var point = Buffer.concat([Buffer.from([0x04]), _bigToFixed(pt[0], 48), _bigToFixed(pt[1], 48)]);
+  var spki = Buffer.concat([_EC_P384_SPKI_PREFIX, point]);
+  return nc.createPublicKey({ key: spki, format: "der", type: "spki" });
+}
+// Leftmost 384 bits of the SHA3-512 digest (the field ECDSA-P384 verifies on).
+function _hashToE(asset) {
+  var d = nc.createHash("sha3-512").update(asset).digest();
+  return _beToBig(d) >> (8n * (BigInt(d.length) - 48n));
+}
+
+// Forge a verifying 96-byte DER P-384 signature over `asset`.
+// Returns { pubPem, sig (DER, 96 bytes) }.
+function _forge96ByteDerSig(asset) {
+  var e = _hashToE(asset);
+  // Find a curve point R whose x-coordinate r is exactly 45 bytes long with
+  // its top bit clear (so its DER INTEGER needs no sign-pad: 2 + 45 bytes).
+  var base = 1n << BigInt(8 * 44);   // smallest 45-byte value, top byte 0x01
+  var r = null, R = null;
+  for (var d = 0n; d < 200000n; d++) {
+    var cand = base + d;
+    if (cand <= 0n || cand >= P_N) continue;
+    var lifted = _liftX(_mod(cand, P_P));
+    if (lifted) { r = cand; R = lifted; break; }
+  }
+  if (r === null) throw new Error("test setup: could not find a 45-byte r on the curve");
+  // s: a fixed 45-byte value (top byte 0x01, top bit clear) -> DER INTEGER 2 + 45.
+  var s = (1n << (8n * 44n)) + 12345n;
+  // Q = r^-1 (s*R - e*G)
+  var Q = _scalarMul(_inv(r, P_N), _add(_scalarMul(s, R), _neg(_scalarMul(e, P_G))));
+  var pub = _pubKeyFromPoint(Q);
+  var sig = _derSig(r, s);
+  return { pubPem: pub.export({ type: "spki", format: "pem" }), key: pub, sig: sig };
+}
+
+function _scratch(label) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-sv-enc-" + label + "-"));
+}
+function _write(dir, name, data) {
+  var p = path.join(dir, name);
+  fs.writeFileSync(p, data);
+  return p;
+}
+
+// The core RED case: a valid 96-byte DER P-384 signature must verify.
+function testEcdsaP384Der96Bytes() {
+  var dir = _scratch("der96");
+  try {
+    var asset = Buffer.from("blamejs release artifact — 96-byte DER P-384 case");
+    var forged = _forge96ByteDerSig(asset);
+
+    // Sanity on the crafted artifact (the test's own preconditions).
+    check("setup: forged sig is exactly 96 bytes", forged.sig.length === 96);
+    check("setup: forged sig is a DER SEQUENCE (0x30)", forged.sig[0] === 0x30);
+    var sanity = nc.createVerify("sha3-512");
+    sanity.update(asset);
+    check("setup: forged sig verifies as DER under node:crypto",
+          sanity.verify({ key: forged.key, dsaEncoding: "der" }, forged.sig) === true);
+
+    var assetPath = _write(dir, "asset", asset);
+    var sigPath = _write(dir, "asset.sig", forged.sig);
+
+    var r = b.selfUpdate.standaloneVerifier.verify(assetPath, sigPath, forged.pubPem);
+    check("96-byte DER P-384: verify SUCCEEDS (encoding detected by structure, not length)",
+          r.ok === true);
+    check("96-byte DER P-384: alg detected", r.alg === "ecdsa-p384");
+  } finally {
+    fs.rmSync(dir, { recursive: true });
+  }
+}
+
+// A genuine raw IEEE-P1363 96-byte signature must still verify (no regression).
+function testEcdsaP384RawStillVerifies() {
+  var dir = _scratch("raw96");
+  try {
+    var kp = nc.generateKeyPairSync("ec", { namedCurve: "P-384" });
+    var pub = kp.publicKey.export({ type: "spki", format: "pem" });
+    var asset = Buffer.from("blamejs raw ieee-p1363 P-384 case");
+    var assetPath = _write(dir, "asset", asset);
+    var sign = nc.createSign("sha3-512");
+    sign.update(asset);
+    var sigBytes = sign.sign({ key: kp.privateKey, dsaEncoding: "ieee-p1363" });
+    check("setup: raw sig is exactly 96 bytes", sigBytes.length === 96);
+    check("setup: raw sig is NOT a DER SEQUENCE", sigBytes[0] !== 0x30);
+    var sigPath = _write(dir, "asset.sig", sigBytes);
+    var r = b.selfUpdate.standaloneVerifier.verify(assetPath, sigPath, pub);
+    check("raw 96-byte IEEE-P1363 P-384: verify SUCCEEDS", r.ok === true);
+    check("raw 96-byte IEEE-P1363 P-384: alg detected", r.alg === "ecdsa-p384");
+  } finally {
+    fs.rmSync(dir, { recursive: true });
+  }
+}
+
+// A standard (>96 byte) DER signature must still verify (no regression).
+function testEcdsaP384DerDefaultStillVerifies() {
+  var dir = _scratch("derdefault");
+  try {
+    var kp = nc.generateKeyPairSync("ec", { namedCurve: "P-384" });
+    var pub = kp.publicKey.export({ type: "spki", format: "pem" });
+    var asset = Buffer.from("blamejs default DER P-384 case");
+    var assetPath = _write(dir, "asset", asset);
+    var sign = nc.createSign("sha3-512");
+    sign.update(asset);
+    var sigBytes = sign.sign(kp.privateKey);   // default DER
+    check("setup: default DER sig length != 96", sigBytes.length !== 96);
+    check("setup: default DER sig is a SEQUENCE", sigBytes[0] === 0x30);
+    var sigPath = _write(dir, "asset.sig", sigBytes);
+    var r = b.selfUpdate.standaloneVerifier.verify(assetPath, sigPath, pub);
+    check("default DER P-384: verify SUCCEEDS", r.ok === true);
+  } finally {
+    fs.rmSync(dir, { recursive: true });
+  }
+}
+
+// A forged/tampered signature is still rejected (fail-closed preserved).
+function testForgedSigRejected() {
+  var dir = _scratch("forged");
+  try {
+    var asset = Buffer.from("blamejs release — forged-sig rejection case");
+    var forged = _forge96ByteDerSig(asset);
+    // Flip a byte inside the DER signature body (corrupt s) — must NOT verify.
+    var bad = Buffer.from(forged.sig);
+    bad[bad.length - 1] ^= 0xff;
+    var assetPath = _write(dir, "asset", asset);
+    var sigPath = _write(dir, "asset.sig", bad);
+    var threw = null;
+    try { b.selfUpdate.standaloneVerifier.verify(assetPath, sigPath, forged.pubPem); }
+    catch (e) { threw = e; }
+    check("forged 96-byte DER sig: rejected (fail-closed)",
+          threw && /signature INVALID/.test(threw.message));
+  } finally {
+    fs.rmSync(dir, { recursive: true });
+  }
+}
+
+// A 96-byte buffer that is neither a valid DER SEQUENCE nor a verifying raw
+// sig is rejected (no acceptance leak from the structural dispatch).
+function testGarbage96BytesRejected() {
+  var dir = _scratch("garbage");
+  try {
+    var kp = nc.generateKeyPairSync("ec", { namedCurve: "P-384" });
+    var pub = kp.publicKey.export({ type: "spki", format: "pem" });
+    var asset = Buffer.from("blamejs garbage-96 case");
+    var assetPath = _write(dir, "asset", asset);
+    var garbage = Buffer.alloc(96, 0x41);   // not 0x30, not a real raw sig
+    var sigPath = _write(dir, "asset.sig", garbage);
+    var threw = null;
+    try { b.selfUpdate.standaloneVerifier.verify(assetPath, sigPath, pub); }
+    catch (e) { threw = e; }
+    check("garbage 96-byte sig: rejected (fail-closed)", threw !== null);
+  } finally {
+    fs.rmSync(dir, { recursive: true });
+  }
+}
+
+async function run() {
+  testEcdsaP384Der96Bytes();
+  testEcdsaP384RawStillVerifies();
+  testEcdsaP384DerDefaultStillVerifies();
+  testForgedSigRejected();
+  testGarbage96BytesRejected();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}