@blamejs/blamejs-shop 0.5.11 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/safe-schema.test.js

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeSchema.SafeSchemaError + b.safeSchema.undefined_ — the schema
+ * error class and the undefined-only leaf schema.
+ *
+ * SafeSchemaError is thrown by every construction-time misuse (bad
+ * union, poisoned shape key) AND by schema.parse() on validation
+ * failure, carrying the full per-field .issues array so one 400 can
+ * report every failing field. It is marked alwaysPermanent so a
+ * validation failure never round-trips through retry / transient-error
+ * logic. undefined_() is the leaf schema that accepts only `undefined`
+ * (implicitly optional) and rejects everything else with an issue code
+ * of "type".
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function run() {
+  var s = b.safeSchema;
+
+  // ---- SafeSchemaError: thrown by parse() on validation failure ----
+  var threw = false;
+  var caught = null;
+  try { s.string().min(3).parse("ab"); }
+  catch (e) { threw = true; caught = e; }
+  check("b.safeSchema.SafeSchemaError: parse() of an invalid value throws", threw);
+  check("SafeSchemaError: instanceof the exported class",
+    caught instanceof b.safeSchema.SafeSchemaError);
+  check("SafeSchemaError: name is SafeSchemaError", caught && caught.name === "SafeSchemaError");
+  check("SafeSchemaError: carries an .issues array", Array.isArray(caught.issues));
+  check("SafeSchemaError: issue[0] has the { path, code, message } shape",
+    caught.issues.length === 1 &&
+    Array.isArray(caught.issues[0].path) &&
+    typeof caught.issues[0].code === "string" &&
+    typeof caught.issues[0].message === "string");
+  check("SafeSchemaError: issue code reflects the failed check (string/too-short)",
+    caught.issues[0].code === "string/too-short");
+
+  // alwaysPermanent — a validation failure must never be retried as if
+  // it were a transient fault. defineClass({ alwaysPermanent: true })
+  // stamps `.permanent = true` on every instance.
+  check("SafeSchemaError: marked permanent so it never round-trips retry",
+    caught.permanent === true);
+
+  // The advertised aggregation guarantee: one throw surfaces EVERY
+  // failing field so HTTP middleware can answer with a single 400.
+  var multiThrew = null;
+  try { s.object({ a: s.string().min(3), b: s.number() }).parse({ a: "x", b: "nope" }); }
+  catch (e) { multiThrew = e; }
+  check("SafeSchemaError: aggregates all failing fields into one .issues array",
+    multiThrew instanceof b.safeSchema.SafeSchemaError && multiThrew.issues.length === 2);
+  check("SafeSchemaError: each aggregated issue carries its field path",
+    multiThrew.issues[0].path[0] === "a" && multiThrew.issues[1].path[0] === "b");
+
+  // ---- SafeSchemaError: also thrown on construction-time misuse ----
+  var badUnion = null;
+  try { s.union([]); }
+  catch (e) { badUnion = e; }
+  check("SafeSchemaError: construction-time misuse (empty union) throws it",
+    badUnion instanceof b.safeSchema.SafeSchemaError && badUnion.code === "safe-schema/bad-union");
+
+  // A prototype-pollution shape key is rejected at construction, not at
+  // parse, so an operator schema can never define one.
+  var poisoned = null;
+  try { s.object({ "constructor": s.string() }); }
+  catch (e) { poisoned = e; }
+  check("SafeSchemaError: a poisoned shape key ('constructor') is refused at construction",
+    poisoned instanceof b.safeSchema.SafeSchemaError && poisoned.code === "safe-schema/poisoned-shape-key");
+
+  // ---- undefined_(): accepts only undefined; implicitly optional ----
+  check("b.safeSchema.undefined_: parse(undefined) returns undefined",
+    b.safeSchema.undefined_().parse(undefined) === undefined);
+
+  var nullThrew = null;
+  try { s.undefined_().parse(null); }
+  catch (e) { nullThrew = e; }
+  check("undefined_: parse(null) throws SafeSchemaError with a type issue",
+    nullThrew instanceof b.safeSchema.SafeSchemaError && nullThrew.issues[0].code === "type");
+
+  var valThrew = null;
+  try { s.undefined_().parse(0); }
+  catch (e) { valThrew = e; }
+  check("undefined_: parse(0) rejects a defined value with a type issue",
+    valThrew instanceof b.safeSchema.SafeSchemaError && valThrew.issues[0].code === "type");
+
+  // safeParse mirrors parse without throwing — the non-throwing consumer
+  // path an operator uses to fold errors into a response body.
+  check("undefined_: safeParse(undefined) is ok:true",
+    s.undefined_().safeParse(undefined).ok === true);
+  var spBad = s.undefined_().safeParse(1);
+  check("undefined_: safeParse(1) is ok:false with the type error code",
+    spBad.ok === false && spBad.errors[0].code === "type");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-sql.test.js

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeSql identifier-shape primitives — the default identifier regex, the
+ * length ceiling, and the typed error class, each proven through the real
+ * validateIdentifier consumer path rather than by existence checks.
+ *
+ * DEFAULT_IDENTIFIER_RE is shown to be the shape validateIdentifier applies by
+ * default (an identifier the regex rejects throws sql/bad-shape; the same
+ * identifier passes once a wider opts.pattern is supplied). MAX_IDENTIFIER_LENGTH
+ * is shown to be the length boundary (one char past it throws sql/too-long;
+ * exactly at it passes). SafeSqlError is shown to be the class every throw
+ * carries, with its stable .code and default code.
+ */
+
+var { check, b } = require("../helpers");
+
+function _code(fn) {
+  try { fn(); return "OK"; }
+  catch (e) { return e && e.code; }
+}
+
+// ---- DEFAULT_IDENTIFIER_RE ----
+
+function testDefaultIdentifierRe() {
+  check("b.safeSql.DEFAULT_IDENTIFIER_RE is the advertised ASCII identifier shape",
+        String(b.safeSql.DEFAULT_IDENTIFIER_RE) === "/^[A-Za-z_][A-Za-z0-9_]*$/");
+
+  // Advertised @example values: a plain snake_case name matches, a
+  // digit-leading name does not.
+  check("DEFAULT_IDENTIFIER_RE matches a plain identifier",
+        b.safeSql.DEFAULT_IDENTIFIER_RE.test("audit_log") === true);
+  check("DEFAULT_IDENTIFIER_RE rejects a digit-leading identifier",
+        b.safeSql.DEFAULT_IDENTIFIER_RE.test("1starts_with_digit") === false);
+
+  // validateIdentifier applies DEFAULT_IDENTIFIER_RE by default: a name the
+  // regex rejects throws sql/bad-shape...
+  check("validateIdentifier accepts a name matching DEFAULT_IDENTIFIER_RE",
+        b.safeSql.validateIdentifier("audit_log") === "audit_log");
+  check("validateIdentifier refuses a name failing DEFAULT_IDENTIFIER_RE",
+        _code(function () { b.safeSql.validateIdentifier("col-1"); }) === "sql/bad-shape");
+
+  // ...and the same name passes once a wider opts.pattern overrides the
+  // default shape — proving the default really was DEFAULT_IDENTIFIER_RE.
+  check("a wider opts.pattern accepts the name the default shape refused",
+        b.safeSql.validateIdentifier("col-1", {
+          pattern: /^[A-Za-z][A-Za-z0-9_-]*$/,
+        }) === "col-1");
+}
+
+// ---- MAX_IDENTIFIER_LENGTH ----
+
+function testMaxIdentifierLength() {
+  check("b.safeSql.MAX_IDENTIFIER_LENGTH is the advertised 63 (Postgres NAMEDATALEN)",
+        b.safeSql.MAX_IDENTIFIER_LENGTH === 63);
+
+  // One char past the ceiling refuses with sql/too-long; exactly at the
+  // ceiling is accepted. Sizing off the constant makes a drift break the test.
+  var tooLong = "a".repeat(b.safeSql.MAX_IDENTIFIER_LENGTH + 1);
+  check("validateIdentifier refuses a name longer than MAX_IDENTIFIER_LENGTH",
+        _code(function () { b.safeSql.validateIdentifier(tooLong); }) === "sql/too-long");
+
+  var atMax = "a".repeat(b.safeSql.MAX_IDENTIFIER_LENGTH);
+  check("validateIdentifier accepts a name exactly at MAX_IDENTIFIER_LENGTH",
+        b.safeSql.validateIdentifier(atMax) === atMax);
+}
+
+// ---- SafeSqlError ----
+
+function testSafeSqlError() {
+  // Every validateIdentifier rejection carries the class with a stable .code.
+  var thrown = null;
+  try { b.safeSql.validateIdentifier("drop"); }
+  catch (e) { thrown = e; }
+  check("validateIdentifier throws a b.safeSql.SafeSqlError",
+        thrown instanceof b.safeSql.SafeSqlError);
+  check("SafeSqlError extends Error", thrown instanceof Error);
+  check("SafeSqlError carries the .isSafeSqlError brand", thrown.isSafeSqlError === true);
+  check("reserved-word rejection carries code sql/reserved-word",
+        thrown.code === "sql/reserved-word");
+
+  // Distinct rejection reasons carry distinct documented codes on the SAME
+  // class — the code is the security signal HTTP middleware branches on.
+  check("bad-shape rejection is a SafeSqlError with code sql/bad-shape",
+        _code(function () { b.safeSql.validateIdentifier("a;b"); }) === "sql/bad-shape");
+  check("non-string input is a SafeSqlError with code sql/bad-type",
+        _code(function () { b.safeSql.validateIdentifier(42); }) === "sql/bad-type");
+
+  // The constructor's documented default code when none is supplied.
+  var bare = new b.safeSql.SafeSqlError("boom");
+  check("SafeSqlError defaults .code to sql/invalid", bare.code === "sql/invalid");
+}
+
+// ---- normalizeForScan ----
+
+function testNormalizeForScan() {
+  // A quoted table/identifier abutting a keyword with NO whitespace gets a
+  // separating space so a whitespace-anchored tokenizer sees the boundary
+  // (the residency write-gate evasion this primitive was extracted to close).
+  check("normalizeForScan inserts a space where a quoted token abuts a word",
+        b.safeSql.normalizeForScan('INSERT INTO"t"(a) VALUES(?)') === 'INSERT INTO "t"(a) VALUES(?)');
+
+  // A slash-star block comment wedged between two keywords collapses to a
+  // single space so the token boundary survives.
+  var blockComment = "UPDATE" + "/*x*/" + "t SET a = ?";
+  check("normalizeForScan collapses an internal block comment to a space",
+        b.safeSql.normalizeForScan(blockComment) === "UPDATE t SET a = ?");
+
+  // A line comment collapses to a single space.
+  check("normalizeForScan collapses a line comment to a space",
+        b.safeSql.normalizeForScan("SELECT 1-- note") === "SELECT 1 ");
+
+  // Quote-aware: a comment marker INSIDE a string literal is copied verbatim,
+  // never treated as a comment (doubled-quote escape respected).
+  var litWithMarker = "SELECT '-- not a comment' AS x";
+  check("normalizeForScan leaves a comment marker inside a string literal intact",
+        b.safeSql.normalizeForScan(litWithMarker) === litWithMarker);
+
+  // Already-whitespace-delimited SQL is returned unchanged (no spurious spaces).
+  var clean = 'INSERT INTO "t" (a) VALUES (?)';
+  check("normalizeForScan is a no-op on already-normalized SQL",
+        b.safeSql.normalizeForScan(clean) === clean);
+
+  // A backtick-quoted (MySQL) identifier abutting a word is also separated.
+  check("normalizeForScan separates a backtick-quoted identifier abutting a word",
+        b.safeSql.normalizeForScan("UPDATE`t` SET a = ?") === "UPDATE `t` SET a = ?");
+}
+
+async function run() {
+  testDefaultIdentifierRe();
+  testMaxIdentifierLength();
+  testSafeSqlError();
+  testNormalizeForScan();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-url.test.js

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeUrl protocol-allowlist presets — the three frozen scheme arrays a
+ * caller passes as opts.allowedProtocols, proven through the real parse gate
+ * rather than by shape checks alone.
+ *
+ * Each preset is asserted for its advertised contents AND its gating behavior:
+ * a URL whose scheme is IN the preset parses and returns the matching
+ * protocol; a URL whose scheme is OUT of it refuses with
+ * safe-url/protocol-disallowed. ALLOW_WS_TLS is the headline case — it permits
+ * wss: and refuses cleartext ws:. The presets are also confirmed frozen, as the
+ * docs promise (a shared allowlist must not be mutable by one caller).
+ */
+
+var { check, b } = require("../helpers");
+
+function _code(fn) {
+  try { fn(); return "OK"; }
+  catch (e) { return e && e.code; }
+}
+
+// ---- ALLOW_WS_TLS (["wss:"]) ----
+
+function testAllowWsTls() {
+  check("b.safeUrl.ALLOW_WS_TLS is the advertised secure-WS allowlist",
+        b.safeUrl.ALLOW_WS_TLS.join(",") === "wss:");
+  check("ALLOW_WS_TLS is frozen (a shared preset must be immutable)",
+        Object.isFrozen(b.safeUrl.ALLOW_WS_TLS));
+
+  // Permits wss:, refuses cleartext ws: — the secure-WebSocket default.
+  check("parse with ALLOW_WS_TLS accepts a wss: URL",
+        b.safeUrl.parse("wss://example.com/stream", {
+          allowedProtocols: b.safeUrl.ALLOW_WS_TLS,
+        }).protocol === "wss:");
+  check("parse with ALLOW_WS_TLS refuses a cleartext ws: URL",
+        _code(function () {
+          b.safeUrl.parse("ws://example.com/stream", {
+            allowedProtocols: b.safeUrl.ALLOW_WS_TLS,
+          });
+        }) === "safe-url/protocol-disallowed");
+}
+
+// ---- ALLOW_WS_ALL (["ws:", "wss:"]) ----
+
+function testAllowWsAll() {
+  check("b.safeUrl.ALLOW_WS_ALL is the advertised ws+wss allowlist",
+        b.safeUrl.ALLOW_WS_ALL.join(",") === "ws:,wss:");
+  check("ALLOW_WS_ALL is frozen", Object.isFrozen(b.safeUrl.ALLOW_WS_ALL));
+
+  // Opt-in cleartext WebSocket: both ws: and wss: parse.
+  check("parse with ALLOW_WS_ALL accepts a cleartext ws: URL",
+        b.safeUrl.parse("ws://127.0.0.1:9000/stream", {
+          allowedProtocols: b.safeUrl.ALLOW_WS_ALL,
+        }).protocol === "ws:");
+  check("parse with ALLOW_WS_ALL accepts a wss: URL",
+        b.safeUrl.parse("wss://example.com/stream", {
+          allowedProtocols: b.safeUrl.ALLOW_WS_ALL,
+        }).protocol === "wss:");
+  // But it is a WebSocket allowlist — an https: URL is a category error here.
+  check("parse with ALLOW_WS_ALL refuses a non-WebSocket https: URL",
+        _code(function () {
+          b.safeUrl.parse("https://example.com/", {
+            allowedProtocols: b.safeUrl.ALLOW_WS_ALL,
+          });
+        }) === "safe-url/protocol-disallowed");
+}
+
+// ---- ALLOW_ANY (["http:", "https:", "ws:", "wss:"]) ----
+
+function testAllowAny() {
+  check("b.safeUrl.ALLOW_ANY is every framework-supported scheme",
+        b.safeUrl.ALLOW_ANY.join(",") === "http:,https:,ws:,wss:");
+  check("b.safeUrl.ALLOW_ANY has the advertised length of 4",
+        b.safeUrl.ALLOW_ANY.length === 4);
+  check("ALLOW_ANY is frozen", Object.isFrozen(b.safeUrl.ALLOW_ANY));
+
+  // Every supported scheme parses under ALLOW_ANY and returns its protocol.
+  var supported = [
+    { url: "http://example.com/",  protocol: "http:" },
+    { url: "https://example.com/", protocol: "https:" },
+    { url: "ws://example.com/",    protocol: "ws:" },
+    { url: "wss://example.com/",   protocol: "wss:" },
+  ];
+  for (var i = 0; i < supported.length; i += 1) {
+    check("parse with ALLOW_ANY accepts " + supported[i].protocol,
+          b.safeUrl.parse(supported[i].url, {
+            allowedProtocols: b.safeUrl.ALLOW_ANY,
+          }).protocol === supported[i].protocol);
+  }
+  // A scheme outside the framework-supported set still refuses.
+  check("parse with ALLOW_ANY refuses an unsupported ftp: scheme",
+        _code(function () {
+          b.safeUrl.parse("ftp://example.com/file", {
+            allowedProtocols: b.safeUrl.ALLOW_ANY,
+          });
+        }) === "safe-url/protocol-disallowed");
+}
+
+async function run() {
+  testAllowWsTls();
+  testAllowWsAll();
+  testAllowAny();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-vcard.test.js

@@ -203,6 +203,31 @@ function testRefusesBadProfile() {
     "safe-vcard/bad-opt");
 }
 
+function testProtoKeyProfileRejected() {
+  // A prototype-member name as the profile must be refused, not resolved to an
+  // inherited member ("constructor" -> Object.prototype.constructor,
+  // "__proto__" -> Object.prototype). The own-property guard in _resolveCaps
+  // rejects it; a bare `if (!PROFILES[name])` truthiness check would pass the
+  // inherited member as a known profile and run under it (fail-open).
+  expectRefused("refuses prototype-key profile 'constructor'",
+    function () { safeVcard.parse(_card(""), { profile: "constructor" }); },
+    "safe-vcard/bad-opt");
+  expectRefused("refuses prototype-key profile '__proto__'",
+    function () { safeVcard.parse(_card(""), { profile: "__proto__" }); },
+    "safe-vcard/bad-opt");
+  // A prototype-member name as the compliancePosture must not resolve to an
+  // inherited member either — the own-property guard skips the unknown posture
+  // and falls back to the strict profile, parsing cleanly.
+  var postureThrew = null, ast = null;
+  try { ast = safeVcard.parse(_card(""), { compliancePosture: "toString" }); }
+  catch (e) { postureThrew = e; }
+  check("prototype-key posture falls back to strict (no fail-open)",
+    postureThrew === null && !!(ast && ast.vcards));
+  // A valid profile still parses.
+  var ok = safeVcard.parse(_card(""), { profile: "balanced" });
+  check("valid profile 'balanced' still parses", !!ok.vcards);
+}
+
 function testRefusesOversizeCards() {
   // strict caps at 16 cards.
   var body = "";
@@ -247,6 +272,7 @@ async function run() {
   testRefusesNestedBegin();
   testRefusesBadInput();
   testRefusesBadProfile();
+  testProtoKeyProfileRejected();
   testRefusesOversizeCards();
   testExtraPropertiesAllowlist();
 }

package/lib/vendor/blamejs/test/layer-0-primitives/scheduler.test.js

@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * scheduler.nextBaselineFire — earliest UTC ms strictly after `after`
+ * whose wall-clock in a timezone matches an HH:MM baseline.
+ *
+ * Pure function: known-answer vectors (UTC + a non-UTC zone + local
+ * clock), the strictly-after / next-day rollover semantics, and the
+ * malformed-input throws.
+ *
+ * Run standalone: `node test/layer-0-primitives/scheduler.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _iso(ms) { return new Date(ms).toISOString(); }
+
+function testNextBaselineFireKnownAnswerUtc() {
+  var when = b.scheduler.nextBaselineFire("02:30", "UTC", new Date("2026-05-09T01:00:00Z"));
+  check("nextBaselineFire UTC known-answer",
+        _iso(when) === "2026-05-09T02:30:00.000Z");
+}
+
+function testNextBaselineFireStrictlyAfter() {
+  // `after` sitting exactly on the target minute must roll to the NEXT day.
+  var when = b.scheduler.nextBaselineFire("02:30", "UTC", new Date("2026-05-09T02:30:00.000Z"));
+  check("nextBaselineFire is strictly-after (rolls a day when at target)",
+        _iso(when) === "2026-05-10T02:30:00.000Z");
+}
+
+function testNextBaselineFireRollsWhenPast() {
+  var when = b.scheduler.nextBaselineFire("02:30", "UTC", new Date("2026-05-09T05:00:00Z"));
+  check("nextBaselineFire rolls to next day when time already passed today",
+        _iso(when) === "2026-05-10T02:30:00.000Z");
+}
+
+function testNextBaselineFireNonUtcZone() {
+  // America/New_York on 2026-05-09 is EDT (UTC-4): 02:30 local = 06:30 UTC.
+  var when = b.scheduler.nextBaselineFire("02:30", "America/New_York", new Date("2026-05-09T00:00:00Z"));
+  check("nextBaselineFire honors a non-UTC timeZone",
+        _iso(when) === "2026-05-09T06:30:00.000Z");
+}
+
+function testNextBaselineFireLocalClock() {
+  // null timeZone follows the server's local clock — assert the local
+  // wall-clock of the result matches the requested HH:MM (TZ-independent).
+  var after = new Date("2026-05-09T00:00:00Z");
+  var when  = b.scheduler.nextBaselineFire("13:45", null, after);
+  var d     = new Date(when);
+  check("nextBaselineFire local-clock matches requested HH:MM",
+        d.getHours() === 13 && d.getMinutes() === 45);
+  check("nextBaselineFire local-clock result is strictly after `after`",
+        when > after.getTime());
+}
+
+function testNextBaselineFireRejectsBadInput() {
+  var t1 = null;
+  try { b.scheduler.nextBaselineFire("2:3", "UTC", new Date()); } catch (e) { t1 = e; }
+  check("nextBaselineFire rejects malformed HH:MM",
+        t1 && t1.code === "scheduler/invalid-baseline");
+  var t2 = null;
+  try { b.scheduler.nextBaselineFire("25:00", "UTC", new Date()); } catch (e) { t2 = e; }
+  check("nextBaselineFire rejects out-of-range hour",
+        t2 && t2.code === "scheduler/invalid-baseline");
+  var t3 = null;
+  try { b.scheduler.nextBaselineFire("12:60", "UTC", new Date()); } catch (e) { t3 = e; }
+  check("nextBaselineFire rejects out-of-range minute",
+        t3 && t3.code === "scheduler/invalid-baseline");
+}
+
+function _sortedSet(s) { return Array.from(s).sort(function (a, b) { return a - b; }); }
+function _eq(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
+
+// A bare number followed by a step (`N/step`) is the Vixie-cron / crontab.guru
+// shorthand for `N-max/step` — it fires at N and every `step` thereafter up to
+// the field maximum, NOT just at the single value N. `5/15` in the minute
+// field is 5,20,35,50 (the same way `*/15` is 0,15,30,45); before the fix it
+// silently collapsed to {5}, so a task the operator meant to run every 15
+// minutes ran once an hour. That silent under-firing is exactly the class the
+// framework already rejects for over-range steps (v0.6.65).
+function testCronBareNumberStep() {
+  var m = b.scheduler.parseCron("5/15 * * * *");
+  check("cron 5/15 minute expands to 5,20,35,50 (N/step == N-max/step)",
+        _eq(_sortedSet(m.minute), [5, 20, 35, 50]));
+
+  var m2 = b.scheduler.parseCron("10/20 * * * *");
+  check("cron 10/20 minute expands to 10,30,50",
+        _eq(_sortedSet(m2.minute), [10, 30, 50]));
+
+  // `0/15` must be identical to `*/15` — both start at 0 and step by 15.
+  var m3 = b.scheduler.parseCron("0/15 * * * *");
+  check("cron 0/15 minute equals */15 (0,15,30,45)",
+        _eq(_sortedSet(m3.minute), [0, 15, 30, 45]));
+
+  var h = b.scheduler.parseCron("* 1/6 * * *");
+  check("cron 1/6 hour expands to 1,7,13,19",
+        _eq(_sortedSet(h.hour), [1, 7, 13, 19]));
+
+  // dom starts at 1: `2/10` day-of-month = 2,12,22 (max 31).
+  var d = b.scheduler.parseCron("0 0 2/10 * *");
+  check("cron 2/10 dom expands to 2,12,22",
+        _eq(_sortedSet(d.dom), [2, 12, 22]));
+
+  // Regressions: forms that must be UNCHANGED by the fix.
+  var star = b.scheduler.parseCron("*/15 * * * *");
+  check("cron */15 unchanged (0,15,30,45)",
+        _eq(_sortedSet(star.minute), [0, 15, 30, 45]));
+  var bare = b.scheduler.parseCron("5 * * * *");
+  check("cron bare 5 (no step) is the single value {5}",
+        _eq(_sortedSet(bare.minute), [5]));
+  var list = b.scheduler.parseCron("0,30 * * * *");
+  check("cron list 0,30 unchanged",
+        _eq(_sortedSet(list.minute), [0, 30]));
+  var range = b.scheduler.parseCron("10-20/5 * * * *");
+  check("cron explicit range 10-20/5 unchanged (10,15,20)",
+        _eq(_sortedSet(range.minute), [10, 15, 20]));
+}
+
+// nextCronFire must actually fire at every step position of an `N/step`
+// schedule — the real consumer path a queue cron-repeat / scheduler task
+// drives. `5/15` fires at :05, :20, :35, :50, then :05 the next hour.
+function testCronBareNumberStepNextFire() {
+  var cron = b.scheduler.parseCron("5/15 * * * *");
+  var t = new Date("2026-05-09T00:00:00Z");
+  var fires = [];
+  for (var i = 0; i < 5; i++) {
+    var next = b.scheduler.nextCronFire(cron, t, "UTC");
+    fires.push(new Date(next).toISOString().slice(11, 16));
+    t = new Date(next);
+  }
+  check("nextCronFire 5/15 fires at every 15-min step, not once an hour",
+        _eq(fires, ["00:05", "00:20", "00:35", "00:50", "01:05"]));
+}
+
+async function run() {
+  testNextBaselineFireKnownAnswerUtc();
+  testNextBaselineFireStrictlyAfter();
+  testNextBaselineFireRollsWhenPast();
+  testNextBaselineFireNonUtcZone();
+  testNextBaselineFireLocalClock();
+  testNextBaselineFireRejectsBadInput();
+  testCronBareNumberStep();
+  testCronBareNumberStepNextFire();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[scheduler] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e); process.exit(1); }
+  );
+}