@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/api-snapshot.js

@@ -38,9 +38,11 @@
  *   and internal helpers.
  *
  *   Function-arity changes: a DECREASE in `fn.length` is breaking
- *   (the operator removed a required parameter). An INCREASE is not
- *   flagged because adding an optional trailing parameter is additive
- *   to existing callers.
+ *   (the operator removed a required parameter). An INCREASE is
+ *   additive rather than breaking — a trailing optional parameter
+ *   cannot break an existing caller — but it IS reported, because the
+ *   baseline records arity: leaving it silent means the committed
+ *   snapshot goes stale while the gate prints "no changes".
  *
  *   On-disk format: stable canonical JSON ordered as
  *   `{ version, frameworkVersion, createdAt, exports }`. The format
@@ -310,18 +312,30 @@ function _walkCompare(oldNode, newNode, prefix, breaking, additive, typeChanged)
     return;
   }
 
-  // For function nodes, arity DROPS are flagged (operator removed a
-  // required parameter). Arity INCREASES are not flagged (added
-  // optional param at the end is additive).
+  // For function nodes, arity DROPS are breaking (a required parameter was
+  // removed). An INCREASE cannot break a caller — the added parameter is
+  // trailing and optional — but the baseline records arity, so a silent pass
+  // leaves it stale while the gate prints "no changes": exactly how a changed
+  // signature reaches a release untracked. It is reported as additive, the
+  // list that already means "not a failure, refresh the baseline".
   if (oldNode.type === "function") {
-    if (typeof oldNode.arity === "number" && typeof newNode.arity === "number" &&
-        newNode.arity < oldNode.arity) {
-      breaking.push({
-        path: prefix,
-        kind: "arity-decreased",
-        was:  "function/" + oldNode.arity,
-        is:   "function/" + newNode.arity,
-      });
+    if (typeof oldNode.arity === "number" && typeof newNode.arity === "number") {
+      if (newNode.arity < oldNode.arity) {
+        breaking.push({
+          path: prefix,
+          kind: "arity-decreased",
+          was:  "function/" + oldNode.arity,
+          is:   "function/" + newNode.arity,
+        });
+      } else if (newNode.arity > oldNode.arity) {
+        additive.push({
+          path: prefix,
+          type: "function",
+          kind: "arity-increased",
+          was:  "function/" + oldNode.arity,
+          is:   "function/" + newNode.arity,
+        });
+      }
     }
     return;
   }
@@ -367,7 +381,9 @@ function _walkCompare(oldNode, newNode, prefix, breaking, additive, typeChanged)
  * member that was removed, retyped, lost arity, swapped its
  * constructor name, or changed primitive `valueType`; the release
  * workflow exits non-zero when this list is non-empty. `additive`
- * lists new members (informational — operator should rerun
+ * lists new members AND functions that gained a trailing parameter
+ * (informational — neither breaks a caller, but both move the
+ * surface the baseline records, so the operator should rerun
  * `capture` and commit the refreshed baseline). `typeChanged` is a
  * subset of `breaking` surfaced separately for easier triage.
  *
@@ -446,7 +462,10 @@ function formatDiff(diff) {
     lines.push("[api-snapshot] additive (" + diff.additive.length + ", informational):");
     for (var j = 0; j < diff.additive.length; j++) {
       var a = diff.additive[j];
-      lines.push("  + " + a.path + " (" + a.type + ")");
+      var aline = "  + " + a.path + " (" + (a.kind || a.type) + ")";
+      if (a.was !== undefined) aline += " was=" + JSON.stringify(a.was);
+      if (a.is !== undefined)  aline += " is="  + JSON.stringify(a.is);
+      lines.push(aline);
     }
   }
   return lines.join("\n");

package/lib/vendor/blamejs/lib/app-shutdown.js

@@ -162,7 +162,7 @@ function create(opts) {
         // don't get a stale 503 served from a CDN.
         if (typeof res.writeHead === "function") {
           var body = JSON.stringify({ error: "service-shutting-down" });
-          res.writeHead(503, {
+          res.writeHead(C.HTTP.STATUS.SERVICE_UNAVAILABLE, {
             "Content-Type":   "application/json; charset=utf-8",
             "Content-Length": Buffer.byteLength(body),
             "Cache-Control":  "no-store",

package/lib/vendor/blamejs/lib/archive-adapters.js

@@ -472,7 +472,7 @@ function http(url, opts) {
       signal:    signal,
       audit:     opts.audit,
     });
-    if (!res || (res.status !== 206 && res.status !== 200)) {
+    if (!res || (res.status !== C.HTTP.STATUS.PARTIAL_CONTENT && res.status !== C.HTTP.STATUS.OK)) {
       throw new AdapterError("adapter/bad-response",
         "http.range: expected 206 Partial Content, got " + (res && res.status));
     }

package/lib/vendor/blamejs/lib/archive.js

@@ -61,6 +61,7 @@ var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var auditEmit = require("./audit-emit");
 var atomicFile = require("./atomic-file");
+var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
@@ -492,25 +493,12 @@ function zip() {
 
   var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
+  // The drain-aware write is b.safeAsync.writeChunk — the same one
+  // b.render.stream uses. It was private here first; a second copy would be a
+  // second chance to get the closed-peer case wrong, which is the half that
+  // hangs a request rather than failing it.
   function _writeChunk(writable, chunk) {
-    return new Promise(function (resolve, reject) {
-      function onError(e) {
-        writable.removeListener("drain", onDrain);
-        reject(e);
-      }
-      function onDrain() {
-        writable.removeListener("error", onError);
-        resolve();
-      }
-      var ok = writable.write(chunk);
-      if (ok) {
-        // Already flushed — no need to wait for drain.
-        resolve();
-        return;
-      }
-      writable.once("drain", onDrain);
-      writable.once("error", onError);
-    });
+    return safeAsync.writeChunk(writable, chunk);
   }
 
   async function _streamEntry(entry, writable) {
@@ -552,9 +540,12 @@ function zip() {
       var sinkWritable = new nodeStream.Writable({
         write: function (chunk, enc, cb) {
           csize += chunk.length;
-          var ok = writable.write(chunk);
-          if (ok) cb();
-          else writable.once("drain", function () { cb(); });
+          // Through the shared writer, so a destination that goes away
+          // mid-entry fails the pipeline instead of leaving `cb` uncalled.
+          // Waiting only for `drain` here meant a destroyed sink never called
+          // back at all: the pipeline never settled, toStream() never settled,
+          // and the listener stayed attached to the dead stream.
+          safeAsync.writeChunk(writable, chunk).then(function () { cb(); }, cb);
         },
       });
       try {
@@ -568,9 +559,7 @@ function zip() {
       var storeCollect = new nodeStream.Writable({
         write: function (chunk, enc, cb) {
           csize += chunk.length;
-          var ok = writable.write(chunk);
-          if (ok) cb();
-          else writable.once("drain", function () { cb(); });
+          safeAsync.writeChunk(writable, chunk).then(function () { cb(); }, cb);
         },
       });
       try {

package/lib/vendor/blamejs/lib/auth/access-lock.js

@@ -40,6 +40,7 @@
  *   });
  */
 
+var C = require("../constants");
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
@@ -147,7 +148,7 @@ function create(opts) {
 
   function _refuse(res, reason) {
     if (!res.writableEnded && typeof res.writeHead === "function") {
-      res.writeHead(503, {
+      res.writeHead(C.HTTP.STATUS.SERVICE_UNAVAILABLE, {
         "Content-Type":  "application/json; charset=utf-8",
         "Retry-After":   "60",
         "Cache-Control": "no-store",

package/lib/vendor/blamejs/lib/auth/bot-challenge.js

@@ -227,12 +227,9 @@ function _normaliseAllowlist(name, val) {
 }
 
 function _httpClientShape(client, callerLabel) {
-  if (client === undefined || client === null) return null;
-  if (typeof client !== "object" || typeof client.request !== "function") {
-    throw new BotChallengeError("bot-challenge/bad-opt",
-      callerLabel + ": httpClient must be a b.httpClient-shaped object (request fn)");
-  }
-  return client;
+  return validateOpts.optionalObjectWithMethod(client, "request",
+    callerLabel + ": httpClient", BotChallengeError, "bot-challenge/bad-opt",
+    "must be a b.httpClient-shaped object (request fn)") || null;
 }
 
 function _normaliseTimeoutMs(val) {

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -103,7 +103,8 @@ var _emitMetric = emit.metric;
  *     scope?:                     string|string[],
  *     deliveryMode:               "poll"|"ping"|"push",
  *     clientNotificationToken?:   string,        // fixed token RP mints once + registers with IdP
- *     httpClientOpts?:            object,
+ *     httpClientOpts?:            object,        // options merged INTO each request
+ *     http?:                      { client?: object, allowedHosts?: string[] },  // the client each request is made THROUGH, and its host pin
  *     allowHttp?:                 boolean,
  *   }
  *
@@ -144,6 +145,13 @@ function create(opts) {
       "auth.ciba.client.create: clientAssertionSigner required for clientAuth='jwt'");
   }
 
+  // The client this flow dials with, and the host pin every dial carries —
+  // shared with the inner OAuth client below so a CIBA flow does not split
+  // across two clients, with the backchannel POST inside an operator's
+  // instrumentation and discovery outside it.
+  var httpOpts = validateOpts.outboundHttpOpts(opts.http, "auth.ciba.client.create",
+                                               AuthError, "auth-ciba");
+
   var deliveryMode = opts.deliveryMode || "poll";
   if (["poll", "ping", "push"].indexOf(deliveryMode) === -1) {
     throw new AuthError("auth-ciba/bad-delivery-mode",
@@ -162,7 +170,13 @@ function create(opts) {
     scope:                             opts.scope,
     backchannelAuthenticationEndpoint: opts.backchannelAuthenticationEndpoint,
     tokenEndpoint:                     opts.tokenEndpoint,
-    httpClientOpts:                    opts.httpClientOpts,
+    // The inner client reads this bag as `httpClient`; handing it over under
+    // the name it is called here meant an operator's configuration applied to
+    // the backchannel and token POSTs and was silently dropped on discovery
+    // and JWKS — the same accepted-but-ignored split the allowInternal note
+    // below records.
+    httpClient:                        opts.httpClientOpts,
+    http:                              opts.http,
     allowHttp:                         opts.allowHttp === true,
     // Thread the SSRF opt-in through to the inner client's discovery / JWKS /
     // token fetches — an operator with an internal-network IdP needs it, and
@@ -260,7 +274,10 @@ function create(opts) {
     safeUrl.parse(url, {
       allowedProtocols: opts.allowHttp === true ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
     });
-    var hc = httpClient();
+    // A supplied client is wrapped in the pin — see the note in oauth.create.
+    var hc = httpOpts.client
+      ? httpClient().pinnedClient(httpOpts.client, httpOpts.allowedHosts)
+      : httpClient();
     var basic = _basicAuthHeader();
     var hdrs = Object.assign({
       "Content-Type": "application/x-www-form-urlencoded",
@@ -280,6 +297,18 @@ function create(opts) {
       responseMode: "always-resolve",
     };
     Object.assign(req, opts.httpClientOpts || {});
+    // Applied after the options bag so a stray allowedHosts there cannot widen
+    // the pin the operator named explicitly.
+    if (httpOpts.allowedHosts) req.allowedHosts = httpOpts.allowedHosts.slice();
+    // Re-checked HERE, not only on the endpoint above: the options bag is
+    // merged in after that check and can carry a `url` of its own, so the
+    // address actually dialed need not be the one that was validated. These
+    // are the requests holding the Basic credentials or the client assertion,
+    // and a host pin does not stand in for the scheme — it deliberately admits
+    // both. This is the last point before the wire.
+    safeUrl.parse(req.url, {
+      allowedProtocols: opts.allowHttp === true ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+    });
     if (opts.allowHttp === true) req.allowedProtocols = safeUrl.ALLOW_HTTP_ALL;
     // Thread the operator's explicit SSRF waiver onto the backchannel-auth
     // and token POSTs too — create() already hands allowInternal to the

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -104,6 +104,32 @@
  *   through `b.httpClient` which enforces the framework's PQC-locked
  *   posture by default (operators with mixed-protocol setups pass
  *   `allowedProtocols`).
+ *
+ *   `http` names the client those fetches are made THROUGH, and the
+ *   hosts they may reach:
+ *
+ *     var oauth = b.auth.oauth.create({
+ *       issuer, clientId, clientSecret,
+ *       http: {
+ *         client:       myHttpClient,          // any { request(opts) }
+ *         allowedHosts: ["api-m.paypal.com"],  // pin every dial
+ *       },
+ *     });
+ *
+ *   Both default to the framework's behaviour. `client` lets a caller
+ *   that already routes its outbound calls through one circuit breaker
+ *   and one retry policy keep the token exchange inside them, rather
+ *   than leaving the endpoint whose failure should open the circuit as
+ *   the one endpoint the circuit cannot see. `allowedHosts` is passed
+ *   to `b.httpClient.request`, which enforces it; it covers discovery
+ *   and JWKS as well as the token endpoint, since a mangled or
+ *   attacker-influenced issuer is read at discovery — pinning only the
+ *   token dial would leave the egress open where it starts.
+ *
+ *   Note `httpClient` (options merged INTO each request) and
+ *   `http.client` (the client each request is made through) are
+ *   different options; the host pin is applied after the options bag,
+ *   so it cannot be widened from there.
  */
 
 var nodeCrypto = require("node:crypto");
@@ -1116,6 +1142,21 @@ function create(opts) {
   var allowHttp        = !!opts.allowHttp;          // localhost dev opt-in (scheme)
   var allowInternal    = opts.allowInternal != null ? opts.allowInternal : null; // localhost dev opt-in (SSRF gate)
   var httpClientOpts   = opts.httpClient || {};
+  // The client this module dials with, and the host pin every dial carries.
+  // `opts.httpClient` is options merged INTO each request; `opts.http.client`
+  // is the client the request is made through. A consumer that instruments its
+  // outbound calls — one circuit breaker, one retry policy, one recorded
+  // transcript — needs the token exchange inside that, or the endpoint whose
+  // failure should open the circuit is the one endpoint the circuit cannot see.
+  // A supplied client is wrapped in the host pin rather than handed it as a
+  // request field: its contract is a `request` method, so it need not know
+  // what allowedHosts means, and an advisory pin a client ignores is no pin.
+  // b.httpClient enforces the field itself, so the unwrapped default is
+  // already covered.
+  var httpOpts   = validateOpts.outboundHttpOpts(opts.http, "oauth.create", OAuthError, "auth-oauth");
+  var httpDialer = httpOpts.client
+    ? httpClient.pinnedClient(httpOpts.client, httpOpts.allowedHosts)
+    : httpClient;
   var responseMode     = opts.responseMode || null;
   // v0.9.5 — client-level opt-out for the kid-less JWKS-of-one
   // refusal added in v0.9.4. Surfaced at the create() level (not
@@ -1218,7 +1259,7 @@ function create(opts) {
 
   async function _fetchJson(url, fetchOpts) {
     fetchOpts = fetchOpts || {};
-    var hc = httpClient;
+    var hc = httpDialer;
     var req = Object.assign({
       url:    url,
       method: "GET",
@@ -1789,7 +1830,7 @@ function create(opts) {
     // Revocation endpoint (RFC 7009) — authenticate with client_secret_post (the
     // credentials stay in the body, universally accepted). tokenEndpointAuthMethod
     // is scoped to the token endpoint; this endpoint may advertise a different one.
-    var hc = httpClient;
+    var hc = httpDialer;
     var req = {
       url:     endpoint,
       method:  "POST",
@@ -1816,6 +1857,22 @@ function create(opts) {
     var ownHeaders = req.headers || {};
     Object.assign(req, httpClientOpts);   // may set req.headers from the operator config (always an object)
     req.headers = Object.assign({}, req.headers, ownHeaders);
+    // The host pin is applied AFTER the options bag, so a stray allowedHosts
+    // in the loose `httpClient` config cannot widen the pin the operator named
+    // explicitly. Every request this module builds passes through here, which
+    // is what makes the pin cover discovery and JWKS as well as the token
+    // endpoint — a mangled issuer is read at discovery, so pinning only the
+    // token dial would leave the SSRF egress open where it actually starts.
+    if (httpOpts.allowedHosts) req.allowedHosts = httpOpts.allowedHosts.slice();
+    // The scheme is this module's requirement, not a side effect of dialing
+    // through b.httpClient. That client refuses a non-TLS destination itself,
+    // so while it was the only dialer the check came for free; a supplied
+    // client carries no such promise, and these requests are the ones holding
+    // the client secret, the authorization code and the access token. An
+    // endpoint reaches here from static config OR from a discovery document,
+    // so it is checked here rather than at either source — this is the last
+    // point before the wire, and after the options bag has had its say.
+    _validateUrl(req.url, allowHttp, "outbound endpoint");
   }
 
   // RFC 7231 §7.1.3 Retry-After → milliseconds. Accepts delta-seconds or an
@@ -1847,7 +1904,7 @@ function create(opts) {
   }
 
   async function _postForm(endpoint, body, extraHeaders, applyTokenClientAuth) {
-    var hc = httpClient;
+    var hc = httpDialer;
     // tokenEndpointAuthMethod (client_secret_basic) is the TOKEN endpoint's client
     // authentication — apply it only to token-endpoint requests. Other endpoints
     // (introspection / revocation / PAR / device-authorization) may advertise a
@@ -2783,7 +2840,7 @@ function create(opts) {
       throw new OAuthError("auth-oauth/no-registration-endpoint",
         "registerClient: AS does not advertise registration_endpoint");
     }
-    var hc      = httpClient;
+    var hc      = httpDialer;
     var headers = {
       "Content-Type": "application/json",
       "Accept":       "application/json",
@@ -2923,10 +2980,10 @@ function create(opts) {
     if (allowHttp) req.allowedProtocols = safeUrl.ALLOW_HTTP_ALL;
     if (allowInternal !== null) req.allowInternal = allowInternal;
     _mergeHttpClientOpts(req);
-    var res = await httpClient.request(req);
+    var res = await httpDialer.request(req);
     if (method === "DELETE") {
-      if (res.statusCode === 204 || res.statusCode === 200) return null;
-      if (res.statusCode === 404) {
+      if (res.statusCode === C.HTTP.STATUS.NO_CONTENT || res.statusCode === C.HTTP.STATUS.OK) return null;
+      if (res.statusCode === C.HTTP.STATUS.NOT_FOUND) {
         throw new OAuthError("auth-oauth/dcr-not-found",
           "deleteClient: 404 — registrationClientUri does not resolve to a client");
       }
@@ -3052,7 +3109,7 @@ function create(opts) {
       // its own request rather than routing through _postForm because it must
       // read the pending/slow_down 400 bodies, so it composes the shared helper).
       var authHeaders = _clientBasicAuthHeaders(body);
-      var hc  = httpClient;
+      var hc  = httpDialer;
       var req = {
         url:     endpoint,
         method:  "POST",

package/lib/vendor/blamejs/lib/auth/password.js

@@ -448,7 +448,7 @@ function policy(opts) {
         return _ok({ breachCheckSkipped: true,
           breachCheckSkipReason: (e && e.message) || String(e) });
       }
-      if (resp.statusCode !== 200 || !resp.body) {
+      if (resp.statusCode !== C.HTTP.STATUS.OK || !resp.body) {
         if (p.failClosed) {
           return _fail("breach-check-failed",
             "HIBP returned status " + resp.statusCode + " with no body");

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -57,6 +57,7 @@ var bCrypto      = require("../crypto");
 var C            = require("../constants");
 var { generateToken, timingSafeEqual } = bCrypto;
 var { AuthError } = require("../framework-error");
+var safeUrl   = require("../safe-url");
 
 var xmlC14n   = lazyRequire(function () { return require("../xml-c14n"); });
 var httpClient = lazyRequire(function () { return require("../http-client"); });
@@ -2138,6 +2139,7 @@ function _sigAlgUrn(alg) {
  *     baseUrl:        string,
  *     entityId:       string,
  *     trustCertPem?:  string,    // PEM of the federation operator's signing cert
+ *     http?:          { client?: object, allowedHosts?: string[] },  // the client the fetch is made through, and its host pin
  *   }
  *
  * @example
@@ -2151,14 +2153,30 @@ async function fetchMdq(opts) {
   validateOpts.requireObject(opts, "auth.saml.fetchMdq", AuthError);
   validateOpts.requireNonEmptyString(opts.baseUrl, "baseUrl", AuthError, "auth-saml/no-mdq-base");
   validateOpts.requireNonEmptyString(opts.entityId, "entityId", AuthError, "auth-saml/no-mdq-entity");
+  var httpOpts = validateOpts.outboundHttpOpts(opts.http, "auth.saml.fetchMdq",
+                                               AuthError, "auth-saml");
   var hash = nodeCrypto.createHash("sha1").update(opts.entityId, "utf8").digest("hex");
   var url = opts.baseUrl.replace(/\/$/, "") + "/entities/%7Bsha1%7D" + hash;
-  var hc = httpClient();
-  var res = await hc.request({
+  // The scheme is checked HERE, not left to whichever client dials. b.httpClient
+  // refuses a non-TLS destination itself, so routing through it was enough while
+  // it was the only client; an injected one carries no such promise, and
+  // trustCertPem is optional — an http:// metadata fetch with no signature to
+  // check lets anyone on the path substitute the federation's signing keys.
+  safeUrl.parse(url, {
+    allowedProtocols: safeUrl.ALLOW_HTTP_TLS,
+    errorClass:       AuthError,
+  });
+  // A supplied client is wrapped in the pin — see the note in oauth.create.
+  var hc = httpOpts.client
+    ? httpClient().pinnedClient(httpOpts.client, httpOpts.allowedHosts)
+    : httpClient();
+  var req = {
     url:    url,
     method: "GET",
     headers: { Accept: "application/samlmetadata+xml" },
-  });
+  };
+  if (httpOpts.allowedHosts) req.allowedHosts = httpOpts.allowedHosts.slice();
+  var res = await hc.request(req);
   if (res.statusCode < 200 || res.statusCode >= 300) {
     throw new AuthError("auth-saml/mdq-fetch-failed",
       "fetchMdq " + url + " returned " + res.statusCode);

package/lib/vendor/blamejs/lib/auth-bot-challenge.js

@@ -243,7 +243,7 @@ function create(opts) {
   function _runBotGuardCheck(req) {
     return new Promise(function (resolve) {
       var capturedRes = {
-        statusCode: 200, // HTTP 200 status code, not bytes
+        statusCode: C.HTTP.STATUS.OK, // HTTP 200 status code, not bytes
         writableEnded: false,
         writeHead: function (status) { capturedRes.statusCode = status; },
         end: function () { capturedRes.writableEnded = true; },
@@ -400,7 +400,7 @@ function create(opts) {
   function _writeChallengeRequired(res) {
     if (!res || res.writableEnded) return;
     if (typeof res.writeHead === "function") {
-      res.writeHead(401, {
+      res.writeHead(C.HTTP.STATUS.UNAUTHORIZED, {
         "Content-Type": "text/plain",
         "WWW-Authenticate": 'Bearer error="bot_challenge_required"',
       });
@@ -413,7 +413,7 @@ function create(opts) {
   function _writeLocked(res) {
     if (!res || res.writableEnded) return;
     if (typeof res.writeHead === "function") {
-      res.writeHead(423, { "Content-Type": "text/plain" });
+      res.writeHead(C.HTTP.STATUS.LOCKED, { "Content-Type": "text/plain" });
     } else if (typeof res.statusCode !== "undefined") {
       res.statusCode = 423;
     }

package/lib/vendor/blamejs/lib/backup/index.js

@@ -2416,7 +2416,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
         // b.objectStore surfaces NOT_FOUND via the framework's
         // err.code === "NOT_FOUND" convention — translate to the
         // backup adapter contract's no-key error.
-        if (e && (e.code === "NOT_FOUND" || e.statusCode === 404 || /NOT_FOUND|not found/i.test(e.message || ""))) {
+        if (e && (e.code === "NOT_FOUND" || e.statusCode === C.HTTP.STATUS.NOT_FOUND || /NOT_FOUND|not found/i.test(e.message || ""))) {
           throw new BackupError("backup/no-key",
             "objectStoreAdapter: key not found: " + JSON.stringify(key));
         }
@@ -2473,7 +2473,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
       } catch (e) {
         // drop-silent on NOT_FOUND — adapter contract is idempotent
         // delete (fsAdapter same shape).
-        if (e && (e.code === "NOT_FOUND" || e.statusCode === 404 || /NOT_FOUND|not found/i.test(e.message || ""))) {
+        if (e && (e.code === "NOT_FOUND" || e.statusCode === C.HTTP.STATUS.NOT_FOUND || /NOT_FOUND|not found/i.test(e.message || ""))) {
           return;
         }
         throw e;
@@ -2484,7 +2484,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
         await client.head(_scopedKey(key));
         return true;
       } catch (e) {
-        if (e && (e.code === "NOT_FOUND" || e.statusCode === 404 || /NOT_FOUND|not found/i.test(e.message || ""))) {
+        if (e && (e.code === "NOT_FOUND" || e.statusCode === C.HTTP.STATUS.NOT_FOUND || /NOT_FOUND|not found/i.test(e.message || ""))) {
           return false;
         }
         throw e;
@@ -2501,7 +2501,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
         var buf = Buffer.isBuffer(body) ? body : Buffer.from(body);
         return buf.slice(0, length);
       } catch (e) {
-        if (e && (e.code === "NOT_FOUND" || e.statusCode === 404 || /NOT_FOUND|not found/i.test(e.message || ""))) {
+        if (e && (e.code === "NOT_FOUND" || e.statusCode === C.HTTP.STATUS.NOT_FOUND || /NOT_FOUND|not found/i.test(e.message || ""))) {
           throw new BackupError("backup/no-key",
             "objectStoreAdapter.readPartial: key not found: " + JSON.stringify(key));
         }
@@ -2514,7 +2514,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
         if (!meta || typeof meta.size !== "number") return null;
         return { size: meta.size, mtimeMs: meta.lastModified || null };
       } catch (e) {
-        if (e && (e.code === "NOT_FOUND" || e.statusCode === 404 || /NOT_FOUND|not found/i.test(e.message || ""))) {
+        if (e && (e.code === "NOT_FOUND" || e.statusCode === C.HTTP.STATUS.NOT_FOUND || /NOT_FOUND|not found/i.test(e.message || ""))) {
           return null;
         }
         throw e;