@blamejs/core 0.15.12 → 0.15.14

package/lib/safe-vcard.js

@@ -62,8 +62,11 @@
  */
 
 var C = require("./constants");
+var codepointClass = require("./codepoint-class");
+var structuredFields = require("./structured-fields");
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var pick = require("./pick");
 
 var SafeVcardError = defineClass("SafeVcardError", { alwaysPermanent: true });
 
@@ -280,13 +283,11 @@ function _parseContentLine(line) {
   var head = line.slice(0, colonIdx);
   var value = line.slice(colonIdx + 1);
 
-  for (var k = 0; k < value.length; k++) {
-    var cc = value.charCodeAt(k);
-    if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {                                                      // C0 + DEL refusal
-      throw new SafeVcardError("safe-vcard/control-char-in-value",
-        "safeVcard.parse: control char 0x" + cc.toString(16) +
-        " in property value (header-injection defense)");
-    }
+  var ctrlAt = codepointClass.firstControlCharOffset(value);                                              // C0 (except TAB) + DEL refusal
+  if (ctrlAt !== -1) {
+    throw new SafeVcardError("safe-vcard/control-char-in-value",
+      "safeVcard.parse: control char 0x" + value.charCodeAt(ctrlAt).toString(16) +
+      " in property value (header-injection defense)");
   }
 
   // RFC 6350 §3.3 — property name may be prefixed by an optional
@@ -310,7 +311,7 @@ function _parseContentLine(line) {
     }
     var pname = seg.slice(0, eq).toUpperCase();
     var pvalue = seg.slice(eq + 1);
-    if (pname === "__proto__" || pname === "constructor" || pname === "prototype") continue;
+    if (pick.isPoisonedKey(pname)) continue;
     if (params[pname]) {
       params[pname].push(_stripDoubleQuotes(pvalue));
     } else {
@@ -331,26 +332,11 @@ function _findUnquotedColon(line) {
 }
 
 function _splitUnquoted(s, sep) {
-  var out = [];
-  var inQ = false;
-  var start = 0;
-  for (var i = 0; i < s.length; i++) {
-    var c = s.charAt(i);
-    if (c === '"') { inQ = !inQ; continue; }
-    if (c === sep && !inQ) {
-      out.push(s.slice(start, i));
-      start = i + 1;
-    }
-  }
-  out.push(s.slice(start));
-  return out;
+  return structuredFields.splitUnquoted(s, sep);
 }
 
 function _stripDoubleQuotes(s) {
-  if (s.length >= 2 && s.charAt(0) === '"' && s.charAt(s.length - 1) === '"') {
-    return s.slice(1, -1);
-  }
-  return s;
+  return structuredFields.stripDoubleQuotes(s);
 }
 
 function _parseVcard(lines, startIdx, caps, extraProps) {
@@ -375,7 +361,7 @@ function _parseVcard(lines, startIdx, caps, extraProps) {
         "safeVcard.parse: nested BEGIN inside VCARD (vCard does not support sub-components)");
     }
     var pn = ln.name;
-    if (!KNOWN_PROPERTIES[pn] && !extraProps[pn] && pn.indexOf("X-") !== 0) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_PROPERTIES, pn) && !extraProps[pn] && pn.indexOf("X-") !== 0) {
       throw new SafeVcardError("safe-vcard/unknown-property",
         "safeVcard.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");
@@ -399,7 +385,7 @@ function _parseVcard(lines, startIdx, caps, extraProps) {
         "safeVcard.parse: property count exceeds maxPropertiesPerCard=" +
         caps.maxPropertiesPerCard);
     }
-    if (pn === "__proto__" || pn === "constructor" || pn === "prototype") {
+    if (pick.isPoisonedKey(pn)) {
       i += 1;
       continue;
     }

package/lib/sandbox-worker.js

@@ -40,6 +40,13 @@ var workerThreads = require("node:worker_threads");
   var allowed = Array.isArray(data.allowedGlobals) ? data.allowedGlobals : [];
   var maxResultBytes = (typeof data.maxResultBytes === "number") ? data.maxResultBytes : null;
 
+  // Capture the real UTF-8 byte counter BEFORE the global strip below deletes
+  // `Buffer`. The result cap is a BYTE budget — measuring the serialized
+  // result with `String.length` (UTF-16 code units) under-enforces it on
+  // multibyte output. A detached `Buffer.byteLength` keeps working after
+  // `delete globalThis.Buffer`.
+  var byteLength = Buffer.byteLength;
+
   var ALWAYS_AVAILABLE = [
     "Object", "Array", "String", "Number", "Boolean", "Symbol",
     "Promise", "Error", "TypeError", "RangeError", "RegExp",
@@ -56,6 +63,12 @@ var workerThreads = require("node:worker_threads");
     "setInterval", "clearInterval",
     "queueMicrotask",
     "global",
+    // WebAssembly linear memory is allocated OUTSIDE the V8 heap, so the
+    // worker's maxOldGenerationSizeMb cap (derived from opts.maxBytes) does
+    // NOT bound `new WebAssembly.Memory(...).grow(N)` — operator source could
+    // commit multi-GiB of off-heap RAM under a tiny maxBytes (CWE-770). It is
+    // not in KNOWN_SAFE_BUILTINS so no `allowed` opt can re-expose it.
+    "WebAssembly",
   ];
   for (var k = 0; k < NODE_BUILTINS.length; k += 1) {
     var nm = NODE_BUILTINS[k];
@@ -113,10 +126,10 @@ var workerThreads = require("node:worker_threads");
       });
       return;
     }
-    if (maxResultBytes !== null && serialized && serialized.length > maxResultBytes) {
+    if (maxResultBytes !== null && serialized && byteLength(serialized, "utf8") > maxResultBytes) {
       workerThreads.parentPort.postMessage({
         ok: false, code: "sandbox/oversized-result",
-        message: "sandbox result exceeded maxResultBytes (" + serialized.length + " > " + maxResultBytes + ")",
+        message: "sandbox result exceeded maxResultBytes (" + byteLength(serialized, "utf8") + " > " + maxResultBytes + ")",
         runtimeMs: runtimeMs, peakBytes: peakBytes,
       });
       return;

package/lib/sandbox.js

@@ -82,6 +82,7 @@ var nodePath = require("node:path");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var { SandboxError } = require("./framework-error");
 
@@ -132,7 +133,7 @@ function _validateAllowed(allowed) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] must be a non-empty identifier string");
     }
-    if (!KNOWN_SAFE_BUILTINS[name]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_SAFE_BUILTINS, name)) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] = " + JSON.stringify(name) +
         " is not in the sandbox built-in allowlist " +
@@ -201,9 +202,9 @@ function run(opts) {
     return Promise.reject(new SandboxError("sandbox/bad-input",
       "sandbox.run: opts.input is not JSON-serializable: " + (eSer && eSer.message)));
   }
-  if (inputJson !== null && inputJson.length > maxBytes) {
+  if (inputJson !== null && safeBuffer.byteLengthOf(inputJson) > maxBytes) {
     return Promise.reject(new SandboxError("sandbox/input-too-large",
-      "sandbox.run: opts.input serialized to " + inputJson.length + " bytes (>" + maxBytes + ")"));
+      "sandbox.run: opts.input serialized to " + safeBuffer.byteLengthOf(inputJson) + " bytes (>" + maxBytes + ")"));
   }
 
   var workerThreads;

package/lib/scheduler.js

@@ -40,11 +40,12 @@
  */
 
 var lazyRequire = require("./lazy-require");
-var audit  = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 var log    = lazyRequire(function () { return require("./log").boot("scheduler"); });
 var clusterStorage = require("./cluster-storage");
 var sql = require("./sql");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var C = require("./constants");
 var { SchedulerError } = require("./framework-error");
 
@@ -176,7 +177,7 @@ function parseCron(expr) {
       "cron expression must be a non-empty string", true);
   }
   var trimmed = expr.trim();
-  if (CRON_SHORTHANDS[trimmed.toLowerCase()]) {
+  if (Object.prototype.hasOwnProperty.call(CRON_SHORTHANDS, trimmed.toLowerCase())) {
     trimmed = CRON_SHORTHANDS[trimmed.toLowerCase()];
   }
   var fields = trimmed.split(/\s+/);
@@ -417,15 +418,7 @@ function create(opts) {
 
   var _err = SchedulerError.factory;
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome,
-      metadata: info || {},
-      reason:   info && info.reason ? info.reason : null,
-    });
-  }
+  var _emit = auditEmit.gatedReasonEmitter({ audit: auditOn });
 
   function _isLeaderHere() {
     if (!clusterInstance) return true;
@@ -447,10 +440,10 @@ function create(opts) {
     if (typeof spec.name !== "string" || spec.name.length === 0) {
       throw _err("INVALID_NAME", "scheduler.schedule: spec.name is required", true);
     }
-    if (tasks.has(spec.name)) {
+    boundedMap.requireAbsent(tasks, spec.name, function () {
       throw _err("DUPLICATE_NAME",
         "scheduler.schedule: '" + spec.name + "' is already scheduled", true);
-    }
+    });
 
     var hasCron     = typeof spec.cron === "string";
     var hasEvery    = typeof spec.every === "number";
@@ -718,8 +711,24 @@ function create(opts) {
     });
   }
 
+  // Node coerces a setTimeout delay greater than the 32-bit signed max
+  // (2147483647 ms ≈ 24.8 days) to 1 ms — so a far-future task would fire
+  // immediately, and an interval longer than the max would tight-loop. Wait
+  // the max chunk, then re-arm for the remainder WITHOUT firing.
+  var TIMEOUT_MAX_MS = 2147483647;
+
   function _arm(task) {
     var delay = Math.max(0, task.nextRun - Date.now());
+    if (delay > TIMEOUT_MAX_MS) {
+      var tc = setTimeout(function () {
+        timers.delete(tc);
+        if (!started) return;
+        _arm(task);                                // re-arm for the remaining delay; do NOT fire yet
+      }, TIMEOUT_MAX_MS);
+      if (typeof tc.unref === "function") tc.unref();
+      timers.add(tc);
+      return;
+    }
     var t = setTimeout(function () {
       timers.delete(t);
       if (!started) return;

package/lib/sec-cyber.js

@@ -94,45 +94,90 @@ function eightKArtifact(opts) {
     throw SecCyberError.factory("sec-cyber/bad-opts",
       "secCyber.eightKArtifact: opts required");
   }
-  validateOpts.requireNonEmptyString(opts.incidentId,
-    "secCyber.eightKArtifact: incidentId", SecCyberError, "BAD_INCIDENT_ID");
-  if (!opts.registrant || typeof opts.registrant !== "object") {
-    throw SecCyberError.factory("sec-cyber/bad-registrant",
-      "secCyber.eightKArtifact: registrant object required");
-  }
-  validateOpts.requireNonEmptyString(opts.registrant.name,
-    "secCyber.eightKArtifact: registrant.name", SecCyberError, "BAD_REGISTRANT_NAME");
-  validateOpts.requireNonEmptyString(opts.registrant.cik,
-    "secCyber.eightKArtifact: registrant.cik", SecCyberError, "BAD_CIK");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.detectedAt,
-    "secCyber.eightKArtifact: detectedAt", SecCyberError, "BAD_DETECTED_AT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.materialityDeterminedAt,
-    "secCyber.eightKArtifact: materialityDeterminedAt", SecCyberError, "BAD_MAT_AT");
-
-  if (FINDINGS.indexOf(opts.materialityFinding) === -1) {
-    throw SecCyberError.factory("sec-cyber/bad-finding",
-      "secCyber.eightKArtifact: materialityFinding must be one of " + FINDINGS.join(", "));
-  }
-  validateOpts.requireNonEmptyString(opts.materialityReasoning,
-    "secCyber.eightKArtifact: materialityReasoning", SecCyberError, "BAD_REASONING");
-
-  if (opts.materialityFinding === "material") {
-    validateOpts.requireNonEmptyString(opts.nature,
-      "secCyber.eightKArtifact: nature", SecCyberError, "BAD_NATURE");
-    validateOpts.requireNonEmptyString(opts.scope,
-      "secCyber.eightKArtifact: scope", SecCyberError, "BAD_SCOPE");
-    validateOpts.requireNonEmptyString(opts.timing,
-      "secCyber.eightKArtifact: timing", SecCyberError, "BAD_TIMING");
-    validateOpts.requireNonEmptyString(opts.impact,
-      "secCyber.eightKArtifact: impact", SecCyberError, "BAD_IMPACT");
-  }
+  validateOpts.shape(opts, {
+    incidentId: "required-string",
+    registrant: function (registrant) {
+      if (!registrant || typeof registrant !== "object") {
+        throw SecCyberError.factory("sec-cyber/bad-registrant",
+          "secCyber.eightKArtifact: registrant object required");
+      }
+      validateOpts.requireNonEmptyString(registrant.name,
+        "secCyber.eightKArtifact: registrant.name", SecCyberError, "BAD_REGISTRANT_NAME");
+      validateOpts.requireNonEmptyString(registrant.cik,
+        "secCyber.eightKArtifact: registrant.cik", SecCyberError, "BAD_CIK");
+    },
+    detectedAt: function (detectedAt) {
+      numericBounds.requirePositiveFiniteIntIfPresent(detectedAt,
+        "secCyber.eightKArtifact: detectedAt", SecCyberError, "BAD_DETECTED_AT");
+    },
+    materialityDeterminedAt: function (materialityDeterminedAt) {
+      numericBounds.requirePositiveFiniteIntIfPresent(materialityDeterminedAt,
+        "secCyber.eightKArtifact: materialityDeterminedAt", SecCyberError, "BAD_MAT_AT");
+    },
+    // materialityFinding / materialityReasoning and the material-only fields
+    // (nature/scope/timing/impact) and the AG-delay fields each carry their own
+    // per-field code (BAD_FINDING / BAD_REASONING / BAD_NATURE / ... /
+    // BAD_AG_JUSTIFICATION). Cross-field requiredness (the material-only and
+    // AG-delay fields) lives in the function rule via the 5th `opts` arg, so the
+    // whole contract is enforced inside this one exhaustive shape.
+    materialityFinding: function (v) {
+      if (FINDINGS.indexOf(v) === -1) {
+        throw SecCyberError.factory("sec-cyber/bad-finding",
+          "secCyber.eightKArtifact: materialityFinding must be one of " + FINDINGS.join(", "));
+      }
+    },
+    materialityReasoning: function (v) {
+      validateOpts.requireNonEmptyString(v,
+        "secCyber.eightKArtifact: materialityReasoning", SecCyberError, "BAD_REASONING");
+    },
+    nature: function (v, label, e, c, o) {
+      if (o.materialityFinding === "material") {
+        validateOpts.requireNonEmptyString(v,
+          "secCyber.eightKArtifact: nature", SecCyberError, "BAD_NATURE");
+      } else {
+        validateOpts.optionalNonEmptyString(v, label, e, c);
+      }
+    },
+    scope: function (v, label, e, c, o) {
+      if (o.materialityFinding === "material") {
+        validateOpts.requireNonEmptyString(v,
+          "secCyber.eightKArtifact: scope", SecCyberError, "BAD_SCOPE");
+      } else {
+        validateOpts.optionalNonEmptyString(v, label, e, c);
+      }
+    },
+    timing: function (v, label, e, c, o) {
+      if (o.materialityFinding === "material") {
+        validateOpts.requireNonEmptyString(v,
+          "secCyber.eightKArtifact: timing", SecCyberError, "BAD_TIMING");
+      } else {
+        validateOpts.optionalNonEmptyString(v, label, e, c);
+      }
+    },
+    impact: function (v, label, e, c, o) {
+      if (o.materialityFinding === "material") {
+        validateOpts.requireNonEmptyString(v,
+          "secCyber.eightKArtifact: impact", SecCyberError, "BAD_IMPACT");
+      } else {
+        validateOpts.optionalNonEmptyString(v, label, e, c);
+      }
+    },
+    agDelayRequested:     "optional-boolean",
+    agDelayJustification: function (v, label, e, c, o) {
+      if (o.agDelayRequested === true) {
+        validateOpts.requireNonEmptyString(v,
+          "secCyber.eightKArtifact: agDelayJustification (required when agDelayRequested=true)",
+          SecCyberError, "BAD_AG_JUSTIFICATION");
+      } else {
+        validateOpts.optionalNonEmptyString(v, label, e, c);
+      }
+    },
+    // audit is a boolean toggle (`opts.audit !== false` suppresses emission);
+    // the emit uses the module-level b.audit sink, not this value.
+    audit:                "optional-boolean",
+  }, "secCyber.eightKArtifact", SecCyberError, "BAD_INCIDENT_ID");
 
   var agDelayRequested = opts.agDelayRequested === true;
-  if (agDelayRequested) {
-    validateOpts.requireNonEmptyString(opts.agDelayJustification,
-      "secCyber.eightKArtifact: agDelayJustification (required when agDelayRequested=true)",
-      SecCyberError, "BAD_AG_JUSTIFICATION");
-  }
 
   var matAt = opts.materialityDeterminedAt || Date.now();
   var deadline = agDelayRequested ? null : _addBusinessDays(matAt, 4);

package/lib/seeders.js

@@ -55,6 +55,7 @@
  */
 
 var nodePath = require("node:path");
+var moduleLoader = require("./module-loader");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var dbSchema = require("./db-schema");
@@ -190,18 +191,10 @@ function _listSeedFiles(rootDir, env) {
 }
 
 function _loadSeed(rootDir, env, file) {
-  var fullPath = nodePath.join(_envDir(rootDir, env), file);
-  // Drop require cache for this path so a test rewriting a fixture
-  // between calls picks it up. Production restarts the process anyway.
-  try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }
-  var mod;
-  // Operator-supplied seed — dynamic by design, can't be bundle-traced.
-  // Host-CLI scope; deploying via SEA / pkg drops this surface.
-  try { mod = require(fullPath); }   // allow:dynamic-require — operator-supplied seed
-  catch (e) {
-    throw _err("LOAD_FAILED",
+  var mod = moduleLoader.requireFresh(nodePath.join(_envDir(rootDir, env), file), function (e) {
+    return _err("LOAD_FAILED",
       "seed '" + env + "/" + file + "' failed to load: " + ((e && e.message) || String(e)));
-  }
+  });
   if (!mod || typeof mod.run !== "function") {
     throw _err("BAD_SEED",
       "seed '" + env + "/" + file + "' must export an async `run(db, ctx)` function");

package/lib/self-update-standalone-verifier.js

@@ -181,6 +181,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   var signature;
   try {
     var sigStat = nodeFs.fstatSync(sigFd);
+    // Bound the alloc: the largest supported signature (ML-DSA-87) is ~4.6 KB;
+    // 64 KiB is far above any legitimate sig and stops Buffer.allocUnsafe(stat.size)
+    // from OOM-ing if signaturePath is pointed at a giant file. Zero-dep by
+    // contract — inline literal, cannot import C.BYTES.
+    if (sigStat.size > 64 * 1024) {   // allow:raw-byte-literal — zero-dep module
+      throw new Error("standalone-verifier.verify: signature file implausibly large (" +
+                      sigStat.size + " bytes)");
+    }
     signature = Buffer.allocUnsafe(sigStat.size);
     if (sigStat.size > 0) nodeFs.readSync(sigFd, signature, 0, sigStat.size, 0);
   } finally {
@@ -219,6 +227,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   // to come from the same {0..assetStat.size} range fixed at open
   // time.
   var assetStat = nodeFs.fstatSync(assetFd);
+  // Bound the asset alloc before Buffer.allocUnsafe(assetStat.size): a self-update
+  // bundle (SEA) is intentionally large, so the ceiling is generous (2 GiB), but
+  // it stops a signaturePath/assetPath pointed at an unbounded file from OOM-ing
+  // the verifier before any byte is hashed. Zero-dep by contract — inline literal.
+  if (assetStat.size > 2 * 1024 * 1024 * 1024) {   // allow:raw-byte-literal — zero-dep module, 2 GiB asset ceiling
+    throw new Error("standalone-verifier.verify: asset implausibly large (" +
+                    assetStat.size + " bytes) — exceeds the 2 GiB self-update ceiling");
+  }
   var sha256 = nodeCrypto.createHash("sha256");
   var sha3   = nodeCrypto.createHash("sha3-512");
   var verifier = (alg === "ecdsa-p384") ? nodeCrypto.createVerify("sha3-512") : null;

package/lib/self-update.js

@@ -57,13 +57,12 @@ var bCrypto = require("./crypto");
 var httpClient = require("./http-client");
 var safeJson = require("./safe-json");
 var { URL: NodeUrl } = require("node:url");
-var lazyRequire = require("./lazy-require");
 var C = require("./constants");
 var standaloneVerifier = require("./self-update-standalone-verifier");
 var { boot } = require("./log");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var SelfUpdateError = defineClass("SelfUpdateError", { alwaysPermanent: true });
 var log = boot("self-update");
@@ -76,13 +75,7 @@ var DEFAULT_HASH_ALG  = "sha3-512";
 var DEFAULT_RELEASES_BYTES = C.BYTES.mib(8);     // GitHub releases JSON ~hundreds of KB; 8 MiB caps a malicious response
 
 function _safeAuditEmit(action, outcome, metadata) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata || {},
-    });
-  } catch (_e) { /* drop-silent — by design */ }
+  auditEmit.emit(action, metadata, outcome);
 }
 
 // ---- semver-shaped comparison (tag_name like "v0.7.30" or "0.7.30") ----
@@ -218,44 +211,66 @@ function _compareTags(a, b) {
 // ---- poll ----
 
 function _validatePollOpts(opts) {
-  validateOpts.requireObject(opts, "selfUpdate.poll", SelfUpdateError, "selfupdate/bad-opts");
-  validateOpts.requireNonEmptyString(opts.releasesUrl,
-    "selfUpdate.poll: opts.releasesUrl", SelfUpdateError, "selfupdate/bad-releases-url");
-  // Scheme enforcement at config-time so the bug surfaces here, not
-  // inside the request loop. Default policy: https only. Operators
-  // wiring against an internal mirror can pass allowedProtocols
-  // explicitly to opt in to http (e.g. a TLS-terminating proxy
-  // upstream of the framework process). The full SSRF / hostname /
-  // length policy still runs inside httpClient.request.
-  var parsedProto;
-  try { parsedProto = new NodeUrl(opts.releasesUrl).protocol; }
-  catch (_e) {
-    throw new SelfUpdateError("selfupdate/bad-releases-url",
-      "selfUpdate.poll: opts.releasesUrl is not parseable as a URL");
-  }
-  var allowedProtocols = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
-    ? opts.allowedProtocols.slice() : ["https:"];
-  if (allowedProtocols.indexOf(parsedProto) === -1) {
-    throw new SelfUpdateError("selfupdate/bad-releases-url",
-      "selfUpdate.poll: opts.releasesUrl protocol '" + parsedProto +
-      "' not in allowedProtocols [" + allowedProtocols.join(", ") + "]");
-  }
-  validateOpts.requireNonEmptyString(opts.currentVersion,
-    "selfUpdate.poll: opts.currentVersion", SelfUpdateError, "selfupdate/bad-current-version");
-  if (opts.assetPattern !== undefined && !(opts.assetPattern instanceof RegExp) &&
-      typeof opts.assetPattern !== "string") {
-    throw new SelfUpdateError("selfupdate/bad-asset-pattern",
-      "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
-  }
-  if (opts.signaturePattern !== undefined && !(opts.signaturePattern instanceof RegExp) &&
-      typeof opts.signaturePattern !== "string") {
-    throw new SelfUpdateError("selfupdate/bad-sig-pattern",
-      "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
-  }
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
-    "selfUpdate.poll: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.timeoutMs,
-    "selfUpdate.poll: opts.timeoutMs", SelfUpdateError, "selfupdate/bad-timeout");
+  validateOpts.shape(opts, {
+    releasesUrl: function (value) {
+      validateOpts.requireNonEmptyString(value,
+        "selfUpdate.poll: opts.releasesUrl", SelfUpdateError, "selfupdate/bad-releases-url");
+      // Scheme enforcement at config-time so the bug surfaces here, not
+      // inside the request loop. Default policy: https only. Operators
+      // wiring against an internal mirror can pass allowedProtocols
+      // explicitly to opt in to http (e.g. a TLS-terminating proxy
+      // upstream of the framework process). The full SSRF / hostname /
+      // length policy still runs inside httpClient.request.
+      var parsedProto;
+      try { parsedProto = new NodeUrl(value).protocol; }
+      catch (_e) {
+        throw new SelfUpdateError("selfupdate/bad-releases-url",
+          "selfUpdate.poll: opts.releasesUrl is not parseable as a URL");
+      }
+      var allowedProtocols = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
+        ? opts.allowedProtocols.slice() : ["https:"];
+      if (allowedProtocols.indexOf(parsedProto) === -1) {
+        throw new SelfUpdateError("selfupdate/bad-releases-url",
+          "selfUpdate.poll: opts.releasesUrl protocol '" + parsedProto +
+          "' not in allowedProtocols [" + allowedProtocols.join(", ") + "]");
+      }
+    },
+    currentVersion: { rule: "required-string", code: "selfupdate/bad-current-version",
+                      label: "selfUpdate.poll: opts.currentVersion" },
+    assetPattern: function (value) {
+      if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
+        throw new SelfUpdateError("selfupdate/bad-asset-pattern",
+          "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
+      }
+    },
+    signaturePattern: function (value) {
+      if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
+        throw new SelfUpdateError("selfupdate/bad-sig-pattern",
+          "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
+      }
+    },
+    maxBytes: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.poll: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+    },
+    timeoutMs: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.poll: opts.timeoutMs", SelfUpdateError, "selfupdate/bad-timeout");
+    },
+    // allowedProtocols is consumed locally (the releasesUrl scheme gate
+    // above reads it) and also forwarded to httpClient.request.
+    allowedProtocols: { rule: "optional-string-array", code: "selfupdate/bad-allowed-protocols",
+                        label: "selfUpdate.poll: opts.allowedProtocols" },
+    // headers is merged onto the outbound request headers locally.
+    headers:          { rule: "optional-plain-object", code: "selfupdate/bad-headers",
+                        label: "selfUpdate.poll: opts.headers" },
+    // etag is used locally for the If-None-Match request header.
+    etag:             { rule: "optional-string", code: "selfupdate/bad-etag",
+                        label: "selfUpdate.poll: opts.etag" },
+    // allowedHosts / allowInternal are forwarded verbatim to
+    // httpClient.request, which owns their SSRF-gate validation.
+  }, "selfUpdate.poll", SelfUpdateError, "selfupdate/bad-opts",
+  { allow: ["allowedHosts", "allowInternal"] });
 }
 
 function _matchAsset(name, pattern, fallback) {
@@ -461,21 +476,25 @@ async function poll(opts) {
 // ---- verify ----
 
 function _validateVerifyOpts(opts) {
-  validateOpts.requireObject(opts, "selfUpdate.verify", SelfUpdateError, "selfupdate/bad-opts");
-  validateOpts.requireNonEmptyString(opts.assetPath,
-    "selfUpdate.verify: opts.assetPath", SelfUpdateError, "selfupdate/bad-asset-path");
-  validateOpts.requireNonEmptyString(opts.signaturePath,
-    "selfUpdate.verify: opts.signaturePath", SelfUpdateError, "selfupdate/bad-signature-path");
-  validateOpts.requireNonEmptyString(opts.pubkeyPem,
-    "selfUpdate.verify: opts.pubkeyPem (PEM-encoded public key)",
-    SelfUpdateError, "selfupdate/bad-pubkey");
-  if (opts.hashAlgo !== undefined &&
-      (typeof opts.hashAlgo !== "string" || ALLOWED_HASH_ALGS.indexOf(opts.hashAlgo) === -1)) {
-    throw new SelfUpdateError("selfupdate/bad-hash-algo",
-      "selfUpdate.verify: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
-  }
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
-    "selfUpdate.verify: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+  validateOpts.shape(opts, {
+    assetPath:     { rule: "required-string", code: "selfupdate/bad-asset-path",
+                     label: "selfUpdate.verify: opts.assetPath" },
+    signaturePath: { rule: "required-string", code: "selfupdate/bad-signature-path",
+                     label: "selfUpdate.verify: opts.signaturePath" },
+    pubkeyPem:     { rule: "required-string", code: "selfupdate/bad-pubkey",
+                     label: "selfUpdate.verify: opts.pubkeyPem (PEM-encoded public key)" },
+    hashAlgo:      function (value) {
+      if (value !== undefined &&
+          (typeof value !== "string" || ALLOWED_HASH_ALGS.indexOf(value) === -1)) {
+        throw new SelfUpdateError("selfupdate/bad-hash-algo",
+          "selfUpdate.verify: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
+      }
+    },
+    maxBytes:      function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.verify: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+    },
+  }, "selfUpdate.verify", SelfUpdateError, "selfupdate/bad-opts");
 }
 
 /**
@@ -565,15 +584,19 @@ async function verify(opts) {
 // ---- swap ----
 
 function _validateSwapOpts(opts, label) {
-  validateOpts.requireObject(opts, "selfUpdate." + label, SelfUpdateError, "selfupdate/bad-opts");
+  // requireObject runs first (shape does it) so an opts-shape error keeps
+  // the selfupdate/bad-opts code. `from` is validated only for swap, and
+  // first to preserve the original field-evaluation order.
+  var schema = {};
   if (label === "swap") {
-    validateOpts.requireNonEmptyString(opts.from,
-      "selfUpdate.swap: opts.from", SelfUpdateError, "selfupdate/bad-from");
+    schema.from = { rule: "required-string", code: "selfupdate/bad-from",
+                    label: "selfUpdate.swap: opts.from" };
   }
-  validateOpts.requireNonEmptyString(opts.to,
-    "selfUpdate." + label + ": opts.to", SelfUpdateError, "selfupdate/bad-to");
-  validateOpts.requireNonEmptyString(opts.backupTo,
-    "selfUpdate." + label + ": opts.backupTo", SelfUpdateError, "selfupdate/bad-backup");
+  schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
+                      label: "selfUpdate." + label + ": opts.to" };
+  schema.backupTo = { rule: "required-string", code: "selfupdate/bad-backup",
+                      label: "selfUpdate." + label + ": opts.backupTo" };
+  validateOpts.shape(opts, schema, "selfUpdate." + label, SelfUpdateError, "selfupdate/bad-opts");
 }
 
 // _safeRollback — best-effort restore of `to` from `backupTo` during