@blamejs/blamejs-shop 0.1.38 → 0.2.1

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-mx.test.js

@@ -3,7 +3,7 @@
  * b.mail.server.mx — inbound SMTP / MX listener.
  *
  * Tests cover the wire-protocol state machine, SMTP-smuggling defense
- * (CVE-2023-51764 / CVE-2024-32178 — bare-LF dot-terminator), open-
+ * (CVE-2023-51764 / -51765 / -51766 — bare-LF dot-terminator), open-
  * relay refusal by default, STARTTLS-stripping defense, and the
  * helper byte-scan primitives (_detectSmugglingShape /
  * _findDotTerminator / _dotUnstuff).
@@ -263,6 +263,169 @@ async function testStrictProfileRequiresStartTls() {
   }
 }
 
+// Connection-level gates (helo / rbl / greylist) wired into the live
+// state machine. Each gate is an operator-supplied object; we drive the
+// real wire protocol with mock gates and assert the SMTP verdict.
+async function testConnectionGates() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) {
+    check("connection gates (skipped — test cert fixture unavailable)", true);
+    return;
+  }
+
+  async function _connect(srv) {
+    var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+    var socket = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { socket.once("connect", r); });
+    await _readGreeting(socket);
+    return socket;
+  }
+
+  // ---- greylist defer → 450 tempfail at RCPT ----
+  var greySrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    greylist: { check: async function () { return { action: "defer", reason: "first-seen" }; } },
+  });
+  var grerr = null, greySock;
+  try {
+    greySock = await _connect(greySrv);
+    await _sendCommand(greySock, "EHLO sender.example.com");
+    await _sendCommand(greySock, "MAIL FROM:<s@external.com>");
+    var greyRcpt = await _sendCommand(greySock, "RCPT TO:<alice@example.com>");
+    check("greylist defer → 450 tempfail", /^450 4\.7\.1/.test(greyRcpt));
+    greySock.destroy();
+  } catch (e) { grerr = e; } finally { await greySrv.close({ timeoutMs: 1000 }); }   // allow:raw-time-literal — test-only short drain
+  check("greylist gate ran without error", grerr === null);
+
+  // ---- RBL listed → 554 at RCPT ----
+  var rblSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    rbl: { query: async function () {
+      return { listed: [{ zone: "zen.spamhaus.org" }], allowed: [], neutral: [], errors: [] };
+    } },
+  });
+  try {
+    var rblSock = await _connect(rblSrv);
+    await _sendCommand(rblSock, "EHLO sender.example.com");
+    await _sendCommand(rblSock, "MAIL FROM:<s@external.com>");
+    var rblRcpt = await _sendCommand(rblSock, "RCPT TO:<alice@example.com>");
+    check("RBL-listed IP → 554 at RCPT", /^554 5\.7\.1/.test(rblRcpt));
+    rblSock.destroy();
+  } finally { await rblSrv.close({ timeoutMs: 1000 }); }                              // allow:raw-time-literal — test-only short drain
+
+  // ---- helo hard-reject → 550 at EHLO ----
+  var heloSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    helo: { evaluate: async function () { return { action: "reject-shape" }; } },
+  });
+  try {
+    var heloSock = await _connect(heloSrv);
+    // A syntactically-valid domain (passes guardDomain) so the refusal
+    // comes from the helo GATE (reject-shape), not domain hardening.
+    var heloReply = await _sendCommand(heloSock, "EHLO sender.example.com");
+    check("helo hard-reject → 550 at EHLO", /^550 5\.7\.1/.test(heloReply));
+    heloSock.destroy();
+  } finally { await heloSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // ---- gates that accept → normal flow (gate ran + passed) ----
+  var passSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    helo:     { evaluate: async function () { return { action: "accept" }; } },
+    rbl:      { query:    async function () { return { listed: [], allowed: [], neutral: [], errors: [] }; } },
+    greylist: { check:    async function () { return { action: "accept", reason: "known" }; } },
+  });
+  try {
+    var passSock = await _connect(passSrv);
+    await _sendCommand(passSock, "EHLO sender.example.com");
+    await _sendCommand(passSock, "MAIL FROM:<s@external.com>");
+    var passRcpt = await _sendCommand(passSock, "RCPT TO:<alice@example.com>");
+    check("accepting gates → RCPT 250", /^250 /.test(passRcpt));
+    passSock.destroy();
+  } finally { await passSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // ---- async-serial pump: pipelined commands (RFC 2920) keep ordering
+  // even though the greylist gate awaits between RCPTs. Send EHLO + MAIL
+  // + RCPT in a single write; the deferred RCPT must still answer 450
+  // and replies must arrive in order. ----
+  var slowCount = 0;
+  var pipeSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    greylist: { check: async function () {
+      slowCount += 1;
+      await helpers.waitUntil(function () { return true; }, { timeoutMs: 100, label: "gate async yield" });
+      return { action: "defer", reason: "first-seen" };
+    } },
+  });
+  try {
+    var pipeInfo = await pipeSrv.listen({ port: 0, address: "127.0.0.1" });
+    var pipeSock = nodeNet.connect(pipeInfo.port, "127.0.0.1");
+    await new Promise(function (r) { pipeSock.once("connect", r); });
+    await _readGreeting(pipeSock);
+    // Pipeline EHLO + MAIL + RCPT in one TCP write.
+    var combined = await new Promise(function (resolve, reject) {
+      var buf = "";
+      function onData(chunk) {
+        buf += chunk.toString("utf8");
+        if (/^450 /m.test(buf)) { pipeSock.removeListener("data", onData); resolve(buf); }
+      }
+      pipeSock.on("data", onData);
+      pipeSock.once("error", reject);
+      pipeSock.write("EHLO sender.example.com\r\nMAIL FROM:<s@external.com>\r\nRCPT TO:<alice@example.com>\r\n");
+    });
+    var idx250ehlo = combined.indexOf("250");
+    var idx450 = combined.indexOf("450");
+    check("pipelined commands answered in order (250… before 450)",
+      idx250ehlo !== -1 && idx450 !== -1 && idx250ehlo < idx450);
+    check("greylist gate ran exactly once for the pipelined RCPT", slowCount === 1);
+    pipeSock.destroy();
+  } finally { await pipeSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+}
+
+// Gates must run + serialize on the POST-STARTTLS path too — the default
+// strict/balanced profiles require STARTTLS before MAIL, so that's where
+// the gates actually fire. Mint a CA so the client can trust the upgraded
+// connection (no rejectUnauthorized bypass), do a real STARTTLS handshake,
+// and assert the greylist gate produces 450 over TLS.
+async function testGateOverStartTls() {
+  var ca, leaf;
+  try {
+    ca = await b.mtlsEngine.generateCa({ name: "mx-starttls-test-ca" });
+    leaf = await b.mtlsEngine.signClientCert({
+      cn: "localhost", caCertPem: ca.caCertPem, caKeyPem: ca.caKeyPem,
+      usage: "server", sans: ["DNS:localhost", "IP:127.0.0.1"], validityDays: 1,
+    });
+  } catch (_e) {
+    check("gate over STARTTLS (skipped — cert fixture unavailable)", true);
+    return;
+  }
+  var ctx = nodeTls.createSecureContext({ key: leaf.key, cert: leaf.cert });
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "strict", localDomains: ["example.com"],
+    greylist: { check: async function () { return { action: "defer", reason: "first-seen" }; } },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var plain, tlsSock;
+  try {
+    plain = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { plain.once("connect", r); });
+    await _readGreeting(plain);
+    await _sendCommand(plain, "EHLO sender.example.com");
+    var stReply = await _sendCommand(plain, "STARTTLS");
+    check("STARTTLS → 220 ready", /^220 /.test(stReply));
+    tlsSock = nodeTls.connect({ socket: plain, ca: [ca.caCertPem], servername: "localhost" });
+    await new Promise(function (r, j) {
+      tlsSock.once("secureConnect", r); tlsSock.once("error", j);
+    });
+    await _sendCommand(tlsSock, "EHLO sender.example.com");   // re-issue per RFC 3207 §4.2
+    await _sendCommand(tlsSock, "MAIL FROM:<s@external.com>");
+    var rcpt = await _sendCommand(tlsSock, "RCPT TO:<alice@example.com>");
+    check("greylist gate runs on the post-STARTTLS serialized pump → 450",
+      /^450 4\.7\.1/.test(rcpt));
+    tlsSock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
 async function run() {
   testSurface();
   testCreateRequiresTlsContext();
@@ -273,6 +436,8 @@ async function run() {
   await testEhloFlow();
   await testRelayRefused();
   await testStrictProfileRequiresStartTls();
+  await testConnectionGates();
+  await testGateOverStartTls();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-cluster.test.js

@@ -25,27 +25,43 @@ var teardownTestDb = helpers.teardownTestDb;
 var _mockReq       = helpers._mockReq;
 var _mockRes       = helpers._mockRes;
 
-function _waitMicrotasks(n) {
-  // Default to 20 ticks (was 5). CI runners under SMOKE_PARALLEL=64
-  // contention need many more setImmediate ticks before the rate-limit
-  // middleware's async take() against the cluster-backend DB has
-  // finished bumping the counter — without enough ticks the next
-  // fire() reads a stale count and the 4th-request-blocked assertion
-  // misfires.
-  var p = Promise.resolve();
-  for (var i = 0; i < (n || 20); i++) p = p.then(function () { return new Promise(function (r) { setImmediate(r); }); });
-  return p;
+// Poll until the rate-limit middleware has resolved a request — either
+// next() ran (the okGetter flips true) or a response was captured (a
+// status was set on the mock res). Replaces a fixed setImmediate-tick
+// drain that flaked under SMOKE_PARALLEL=64 contention: the async take()
+// against the cluster-backend DB sometimes hadn't bumped the counter
+// within the tick budget, so the next fire() read a stale count and the
+// "4th-request-blocked" assertion misfired (§11b — poll the observable
+// condition, never guess a tick/time budget).
+function _settle(res, okGetter) {
+  return helpers.waitUntil(function () {
+    // `ended` is the unambiguous "a response was written" signal —
+    // it flips true only when the mock's end() runs. (status starts
+    // null, so a `status != null` check would read true before any
+    // response and defeat the poll.) A passed request sets ok via
+    // next(); a blocked one ends the response.
+    return okGetter() || res._captured().ended === true;
+  }, { timeoutMs: 5000, label: "rate-limit-cluster: request settled (next ran or response ended)" });
 }
 
 async function testClusterBackendBasicLimit() {
-  // limit=3 / windowMs=10s → first 3 requests pass, 4th blocked.
+  // limit=3 → first 3 requests pass, 4th blocked.
+  // windowMs is a deliberately-large 1h: the fixed-window counter resets
+  // at each `floor(now/windowMs)*windowMs` boundary, so a small window
+  // (e.g. 10s) let the test's sequential awaited calls straddle a window
+  // boundary under SMOKE_PARALLEL=64 CPU contention — the counter reset
+  // mid-test and a "blocked" assertion saw a fresh count (the recurring
+  // rate-limit-cluster flake). A 1h window makes wall-clock progress
+  // during the sub-second test negligible vs the window, so all calls
+  // land in one window. (The rollover test below keeps a small window
+  // on purpose — it needs an aged row to fall into a prior window.)
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-rl-"));
   try {
     await setupTestDb(tmpDir);
     var mw = b.middleware.rateLimit({
       backend:  "cluster",
       limit:    3,
-      windowMs: 10000,
+      windowMs: 3600000,
     });
 
     async function fire() {
@@ -53,7 +69,7 @@ async function testClusterBackendBasicLimit() {
       var res = _mockRes();
       var nextCalled = false;
       mw(req, res, function () { nextCalled = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return nextCalled; });
       return { passed: nextCalled, status: res._captured().status };
     }
 
@@ -83,7 +99,7 @@ async function testClusterBackendIndependentKeys() {
     var mw = b.middleware.rateLimit({
       backend:  "cluster",
       limit:    2,
-      windowMs: 10000,
+      windowMs: 3600000,
       keyFn:    function (req) { return req.headers["x-key"] || "default"; },
     });
 
@@ -92,7 +108,7 @@ async function testClusterBackendIndependentKeys() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
 
@@ -120,7 +136,7 @@ async function testClusterBackendWindowRollover() {
     var mw = b.middleware.rateLimit({
       backend:  "cluster",
       limit:    2,
-      windowMs: 10000,
+      windowMs: 3600000,   // 1h — same straddle-immunity as the other tests
     });
 
     async function fire() {
@@ -128,7 +144,7 @@ async function testClusterBackendWindowRollover() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
 
@@ -136,10 +152,12 @@ async function testClusterBackendWindowRollover() {
     await fire(); await fire();
     check("rollover: 3rd in same window blocked",  !(await fire()));
 
-    // Fast-forward: rewrite the row so its windowStart is well in the past.
+    // Fast-forward: rewrite the row so its windowStart is well in the
+    // past — > one window (1h) back so the next take sees it as a prior
+    // window and rolls the count over.
     b.db.prepare(
       "UPDATE _blamejs_rate_limit_counters SET windowStart = ?, count = ?"
-    ).run(Date.now() - 60000, 99);
+    ).run(Date.now() - 7200000, 99);
 
     // The next take's INSERT...ON CONFLICT sees an older windowStart
     // and rolls count back to 1 → request passes.
@@ -162,7 +180,7 @@ async function testClusterBackendAuditEmit() {
     var mw = b.middleware.rateLimit({
       backend:  "cluster",
       limit:    1,
-      windowMs: 10000,
+      windowMs: 3600000,
     });
 
     async function fire() {
@@ -170,7 +188,7 @@ async function testClusterBackendAuditEmit() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
     await fire();   // pass
@@ -208,7 +226,7 @@ async function testCustomBackendObject() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return ok;
   }
   check("custom backend: 1st passes",           await fire());
@@ -239,7 +257,7 @@ async function testFailOpenOnBackendError() {
   var res = _mockRes();
   var ok = false;
   mw(req, res, function () { ok = true; });
-  await _waitMicrotasks(20);
+  await _settle(res, function () { return ok; });
   check("backend error → middleware fails open",  ok === true);
 }
 
@@ -251,7 +269,7 @@ async function testMemoryFixedWindowBasicLimit() {
     backend:   "memory",
     algorithm: "fixed-window",
     max:       3,
-    windowMs:  10000,
+    windowMs:  3600000,
   });
 
   async function fire() {
@@ -259,7 +277,7 @@ async function testMemoryFixedWindowBasicLimit() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return { passed: ok, status: res._captured().status };
   }
 
@@ -277,7 +295,7 @@ async function testMemoryFixedWindowIndependentKeys() {
     backend:   "memory",
     algorithm: "fixed-window",
     max:       2,
-    windowMs:  10000,
+    windowMs:  3600000,
     keyFn:     function (req) { return req.headers["x-key"] || "default"; },
   });
 
@@ -286,7 +304,7 @@ async function testMemoryFixedWindowIndependentKeys() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return ok;
   }
 

package/lib/vendor/blamejs/test/layer-0-primitives/safe-ical.test.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * b.safeIcal — bounded RFC 5545 iCalendar parser. Tests the AST
- * surface, line unfolding, RRULE caps (CVE-2024-39687 defense),
+ * surface, line unfolding, RRULE caps (calendar-bomb defense),
  * control-char refusal, property allowlist, profile / posture
  * cascades.
  */
@@ -131,7 +131,7 @@ function testRefusesOversizeBytes() {
 }
 
 function testRefusesRecursiveRrule() {
-  // CVE-2024-39687: RRULE COUNT > 10000 refused regardless of profile.
+  // Calendar-bomb defense: RRULE COUNT > 10000 refused regardless of profile.
   expectRefused("refuses RRULE COUNT > 10000",
     function () {
       safeIcal.parse(_ical(_event("RRULE:FREQ=DAILY;COUNT=999999\r\n")));

package/lib/vendor/blamejs/test/layer-0-primitives/sandbox.test.js

@@ -26,7 +26,7 @@ async function testHappyPath() {
   var r = await b.sandbox.run({
     source: "return { upper: input.name.toUpperCase(), len: input.name.length };",
     input:  { name: "alice" },
-    timeoutMs: 5000,
+    timeoutMs: 10000,
   });
   check("happy path returns wrapped result",       typeof r === "object");
   check("happy path produces result.result.upper", r.result && r.result.upper === "ALICE");
@@ -40,7 +40,7 @@ async function testAllowedBuiltins() {
     source:    "return { ts: Date.now() > 0, sqrt: Math.sqrt(16) };",
     input:     {},
     allowed:   ["Date", "Math"],
-    timeoutMs: 5000,
+    timeoutMs: 10000,
   });
   check("allowed Date works",   r.result.ts === true);
   check("allowed Math works",   r.result.sqrt === 4);
@@ -51,7 +51,7 @@ async function testBadAllowedRejected() {
     await b.sandbox.run({
       source:    "return null;",
       allowed:   ["process"],
-      timeoutMs: 5000,
+      timeoutMs: 10000,
     });
     check("bad-allowed should have refused", false);
   } catch (e) {
@@ -62,13 +62,13 @@ async function testBadAllowedRejected() {
 
 async function testBadSourceRejected() {
   try {
-    await b.sandbox.run({ source: "", timeoutMs: 5000 });
+    await b.sandbox.run({ source: "", timeoutMs: 10000 });
     check("empty source should refuse", false);
   } catch (e) {
     check("empty source refused", e && e.code === "sandbox/bad-source");
   }
   try {
-    await b.sandbox.run({ source: 42, timeoutMs: 5000 });
+    await b.sandbox.run({ source: 42, timeoutMs: 10000 });
     check("non-string source should refuse", false);
   } catch (e) {
     check("non-string source refused", e && e.code === "sandbox/bad-source");
@@ -92,7 +92,7 @@ async function testBadTimeoutRejected() {
 
 async function testBadMaxBytesRejected() {
   try {
-    await b.sandbox.run({ source: "return 1;", maxBytes: 100, timeoutMs: 5000 });
+    await b.sandbox.run({ source: "return 1;", maxBytes: 100, timeoutMs: 10000 });
     check("under-floor maxBytes should refuse", false);
   } catch (e) {
     check("under-floor maxBytes refused", e && e.code === "sandbox/bad-max-bytes");
@@ -113,7 +113,7 @@ async function testTimeoutEnforced() {
 
 async function testParseError() {
   try {
-    await b.sandbox.run({ source: "this is not valid javascript ((", timeoutMs: 5000 });
+    await b.sandbox.run({ source: "this is not valid javascript ((", timeoutMs: 10000 });
     check("malformed source should refuse", false);
   } catch (e) {
     check("parse-error returned", e && e.code === "sandbox/parse-error");
@@ -124,7 +124,7 @@ async function testRuntimeError() {
   try {
     await b.sandbox.run({
       source:    "throw new Error('boom');",
-      timeoutMs: 5000,
+      timeoutMs: 10000,
     });
     check("throwing source should reject", false);
   } catch (e) {
@@ -138,7 +138,7 @@ async function testBadInput() {
   var circular = {};
   circular.self = circular;
   try {
-    await b.sandbox.run({ source: "return 1;", input: circular, timeoutMs: 5000 });
+    await b.sandbox.run({ source: "return 1;", input: circular, timeoutMs: 10000 });
     check("circular input should refuse", false);
   } catch (e) {
     check("bad-input refused", e && e.code === "sandbox/bad-input");
@@ -151,7 +151,7 @@ async function testContainment() {
   try {
     await b.sandbox.run({
       source:    "var x = require; return typeof x;",
-      timeoutMs: 5000,
+      timeoutMs: 10000,
     });
     check("require should not be reachable", false);
   } catch (e) {
@@ -163,7 +163,7 @@ async function testProcessUnreachable() {
   try {
     await b.sandbox.run({
       source:    "return process.env.HOME;",
-      timeoutMs: 5000,
+      timeoutMs: 10000,
     });
     check("process should not be reachable", false);
   } catch (e) {
@@ -176,7 +176,7 @@ async function testNoNetworkAccess() {
   try {
     await b.sandbox.run({
       source:    "var http = require('http'); return 1;",
-      timeoutMs: 5000,
+      timeoutMs: 10000,
     });
     check("network access should refuse", false);
   } catch (e) {

package/lib/vendor/blamejs/test/layer-0-primitives/scheduler-exactly-once.test.js

@@ -21,12 +21,6 @@ var check          = helpers.check;
 var setupTestDb    = helpers.setupTestDb;
 var teardownTestDb = helpers.teardownTestDb;
 
-function _waitMicrotasks(n) {
-  var p = Promise.resolve();
-  for (var i = 0; i < (n || 5); i++) p = p.then(function () { return new Promise(function (r) { setImmediate(r); }); });
-  return p;
-}
-
 async function testSingleNodeNoTickClaim() {
   // No opts.cluster wired → tick-claim path skipped entirely. fires
   // increments normally, tickClaimLost stays 0, no rows in the ticks
@@ -38,7 +32,10 @@ async function testSingleNodeNoTickClaim() {
     var sched = b.scheduler.create({ audit: false });
     sched.schedule({ name: "single", every: 60000, run: async function () { fired++; } });
     sched._fireOnce("single");
-    await _waitMicrotasks(5);
+    await helpers.waitUntil(function () {
+      var t = sched.list()[0];
+      return t && t.fires === 1;
+    }, { timeoutMs: 5000, label: "scheduler single-node: fire callback completed" });
     var listed = sched.list()[0];
     check("single-node: fires increments",         listed.fires === 1);
     check("single-node: tickClaimLost stays 0",    listed.tickClaimLost === 0);
@@ -69,7 +66,10 @@ async function testClusterWinnerInsertsTickRow() {
     var nominalRun = task.nextRun;
 
     sched._fireOnce("winner");
-    await _waitMicrotasks(10);
+    await helpers.waitUntil(function () {
+      var t = sched.list()[0];
+      return t && t.fires === 1;
+    }, { timeoutMs: 5000, label: "scheduler winner: tick-claim won + fire completed" });
 
     var listed = sched.list()[0];
     check("winner: fires increments",              listed.fires === 1);
@@ -116,7 +116,13 @@ async function testClusterLoserSkipsAndCounts() {
     );
 
     sched._fireOnce("loser");
-    await _waitMicrotasks(10);
+    // The lost tick-claim is observable as tickClaimLost incrementing —
+    // poll on that rather than a fixed tick budget. Once it lands, the
+    // skipped run (fires stays 0) is guaranteed.
+    await helpers.waitUntil(function () {
+      var t = sched.list()[0];
+      return t && t.tickClaimLost === 1;
+    }, { timeoutMs: 5000, label: "scheduler loser: tick-claim lost recorded" });
 
     var listed = sched.list()[0];
     check("loser: fires stays 0",                  listed.fires === 0);

package/lib/vendor/blamejs/test/layer-0-primitives/websocket-channels.test.js

@@ -16,12 +16,6 @@ var check          = helpers.check;
 var setupTestDb    = helpers.setupTestDb;
 var teardownTestDb = helpers.teardownTestDb;
 
-function _waitMicrotasks(n) {
-  var p = Promise.resolve();
-  for (var i = 0; i < (n || 5); i++) p = p.then(function () { return new Promise(function (r) { setImmediate(r); }); });
-  return p;
-}
-
 // Minimal connection mock — EventEmitter with .send() that captures
 // what was sent. Mirrors the WebSocketConnection surface that
 // websocket-channels actually touches (.send + .on('close')).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.38",
+  "version": "0.2.1",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {