@blamejs/core 0.13.43 → 0.13.44

package/lib/fdx.js

@@ -162,10 +162,10 @@ var FDX_SCHEMAS = {
  */
 function bind(opts) {
   if (!opts || typeof opts !== "object") {
-    throw FdxError.factory("BAD_OPTS", "fdx.bind: opts required");
+    throw FdxError.factory("fdx/bad-opts", "fdx.bind: opts required");
   }
   if (!opts.authServer || typeof opts.authServer !== "object") {
-    throw FdxError.factory("BAD_AUTH_SERVER",
+    throw FdxError.factory("fdx/bad-auth-server",
       "fdx.bind: authServer object required");
   }
   validateOpts.requireNonEmptyString(opts.authServer.issuer,
@@ -174,12 +174,12 @@ function bind(opts) {
     "fdx.bind: authServer.jwksUri", FdxError, "BAD_JWKS_URI");
 
   if (!Array.isArray(opts.resources) || opts.resources.length === 0) {
-    throw FdxError.factory("BAD_RESOURCES",
+    throw FdxError.factory("fdx/bad-resources",
       "fdx.bind: resources must be a non-empty array");
   }
   for (var i = 0; i < opts.resources.length; i += 1) {
     if (FDX_RESOURCES.indexOf(opts.resources[i]) === -1) {
-      throw FdxError.factory("UNKNOWN_RESOURCE",
+      throw FdxError.factory("fdx/unknown-resource",
         "fdx.bind: unknown resource '" + opts.resources[i] +
         "' (allowed: " + FDX_RESOURCES.join(", ") + ")");
     }
@@ -248,7 +248,7 @@ function bind(opts) {
 function validateResponse(resourceType, body) {
   var schema = FDX_SCHEMAS[resourceType];
   if (!schema) {
-    throw FdxError.factory("UNKNOWN_RESOURCE",
+    throw FdxError.factory("fdx/unknown-resource",
       "fdx.validateResponse: unknown resource '" + resourceType + "'");
   }
   if (!body || typeof body !== "object") {
@@ -313,7 +313,7 @@ function validateResponse(resourceType, body) {
  */
 function consentReceipt(opts) {
   if (!opts || typeof opts !== "object") {
-    throw FdxError.factory("BAD_OPTS", "fdx.consentReceipt: opts required");
+    throw FdxError.factory("fdx/bad-opts", "fdx.consentReceipt: opts required");
   }
   validateOpts.requireNonEmptyString(opts.dataProvider,
     "fdx.consentReceipt: dataProvider", FdxError, "BAD_DATA_PROVIDER");
@@ -324,7 +324,7 @@ function consentReceipt(opts) {
   validateOpts.requireNonEmptyString(opts.revocationUrl,
     "fdx.consentReceipt: revocationUrl", FdxError, "BAD_REVOCATION_URL");
   if (!Array.isArray(opts.scopes) || opts.scopes.length === 0) {
-    throw FdxError.factory("BAD_SCOPES",
+    throw FdxError.factory("fdx/bad-scopes",
       "fdx.consentReceipt: scopes must be a non-empty array");
   }
   numericBounds.requirePositiveFiniteIntIfPresent(opts.durationMs,

package/lib/graphql-federation.js

@@ -87,7 +87,7 @@ function _readBody(req, errorClass) {
       try { collector.push(chunk); }
       catch (_e) {
         req.destroy();
-        reject(errorClass.factory("BODY_TOO_LARGE",
+        reject(errorClass.factory("graphql-federation/body-too-large",
           "graphqlFederation: body exceeds " + cap + " bytes"));
       }
     });
@@ -133,7 +133,7 @@ function guardSdl(opts) {
   var publicSchemaOk = opts.publicSchemaOk === true;
   var routerToken = typeof opts.routerToken === "string" ? opts.routerToken : null;
   if (!publicSchemaOk && (!routerToken || routerToken.length < ROUTER_TOKEN_MIN_LEN)) {
-    throw errorClass.factory("BAD_OPTS",
+    throw errorClass.factory("graphql-federation/bad-opts",
       "graphqlFederation.guardSdl: routerToken (32+ char) required unless publicSchemaOk=true");
   }
   var nonceStore = opts.nonceStore && typeof opts.nonceStore.has === "function" &&

package/lib/iab-mspa.js

@@ -74,11 +74,11 @@ var DATA_USES = ["sale", "sharing", "targeted-ads", "sensitive", "child-data"];
  */
 function parseGpp(gppString) {
   if (typeof gppString !== "string" || gppString.length === 0) {
-    throw IabMspaError.factory("BAD_INPUT",
+    throw IabMspaError.factory("iab-mspa/bad-input",
       "iabMspa.parseGpp: gppString required");
   }
   if (gppString.length > 8192) {                                                              // allow:raw-byte-literal — GPP string cap, not bytes
-    throw IabMspaError.factory("INPUT_TOO_LARGE",
+    throw IabMspaError.factory("iab-mspa/input-too-large",
       "iabMspa.parseGpp: gppString exceeds 8192 chars");
   }
   // GPP framing: <header>~<section1>~<section2>...
@@ -157,11 +157,11 @@ function parseGpp(gppString) {
  */
 function checkOptOut(parsed, opts) {
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.sections)) {
-    throw IabMspaError.factory("BAD_PARSED",
+    throw IabMspaError.factory("iab-mspa/bad-parsed",
       "iabMspa.checkOptOut: parsed object required (call parseGpp first)");
   }
   if (!opts || DATA_USES.indexOf(opts.dataUse) === -1) {
-    throw IabMspaError.factory("BAD_DATA_USE",
+    throw IabMspaError.factory("iab-mspa/bad-data-use",
       "iabMspa.checkOptOut: opts.dataUse must be one of " + DATA_USES.join(", "));
   }
   var signals = [];
@@ -214,7 +214,7 @@ function refuseProcessing(parsed, opts) {
         signals: rv.signals,
       },
     });
-    throw IabMspaError.factory("OPT_OUT_HONORED",
+    throw IabMspaError.factory("iab-mspa/opt-out-honored",
       "iabMspa: opt-out signal must be honored for dataUse='" + opts.dataUse +
       "' (signals: " + rv.signals.join(", ") + ")");
   }

package/lib/iab-tcf.js

@@ -116,7 +116,7 @@ function _b64urlDecode(s) {
   var pad = padded.length % 4;
   if (pad === 2) padded += "==";
   else if (pad === 3) padded += "=";
-  else if (pad === 1) throw IabTcfError.factory("BAD_BASE64",
+  else if (pad === 1) throw IabTcfError.factory("iab-tcf/bad-base64",
     "iabTcf: base64url segment has invalid length");
   return Buffer.from(padded, "base64");
 }
@@ -127,7 +127,7 @@ function _bitReader(buf) {
   var totalBits = buf.length * 8;                                                             // allow:raw-byte-literal — bits per byte
   function read(n) {
     if (bitOffset + n > totalBits) {
-      throw IabTcfError.factory("BAD_LENGTH",
+      throw IabTcfError.factory("iab-tcf/bad-length",
         "iabTcf: read past end of segment (offset=" + bitOffset + " want=" + n + " total=" + totalBits + ")");
     }
     // Accumulate with `* 2`, not `<< 1`: the Created / LastUpdated fields are
@@ -288,7 +288,7 @@ function _parseSecondaryVendorSegment(buf, expectedType) {
   var r = _bitReader(buf);
   var segType = r.read(3);                                                                     // allow:raw-byte-literal — TCF spec field width
   if (segType !== expectedType) {
-    throw IabTcfError.factory("BAD_SEGMENT_TYPE",
+    throw IabTcfError.factory("iab-tcf/bad-segment-type",
       "iabTcf: expected segment type " + expectedType + ", got " + segType);
   }
   return _parseVendorSection(r);
@@ -318,18 +318,18 @@ function _parseSecondaryVendorSegment(buf, expectedType) {
  */
 function parseString(tcString) {
   if (typeof tcString !== "string" || tcString.length === 0) {
-    throw IabTcfError.factory("BAD_INPUT",
+    throw IabTcfError.factory("iab-tcf/bad-input",
       "iabTcf.parseString: tcString must be a non-empty string");
   }
   if (tcString.length > MAX_TC_STRING_BYTES) {
-    throw IabTcfError.factory("INPUT_TOO_LARGE",
+    throw IabTcfError.factory("iab-tcf/input-too-large",
       "iabTcf.parseString: tcString exceeds " + MAX_TC_STRING_BYTES + " bytes");
   }
   var segments = tcString.split(".");
   var coreBuf;
   try { coreBuf = _b64urlDecode(segments[0]); }
   catch (e) {
-    throw IabTcfError.factory("BAD_CORE",
+    throw IabTcfError.factory("iab-tcf/bad-core",
       "iabTcf.parseString: core segment base64url decode failed: " + e.message);
   }
   var core = _parseCore(coreBuf);
@@ -425,7 +425,7 @@ function requireV23Disclosed(tcString, opts) {
         metadata: { coreVersion: parsed.core.version, required: TCF_V23_CORE_VERSION },
       });
     }
-    throw IabTcfError.factory("WRONG_CORE_VERSION",
+    throw IabTcfError.factory("iab-tcf/wrong-core-version",
       "iabTcf: core version " + parsed.core.version + " not v2.3 (required " +
       TCF_V23_CORE_VERSION + ")");
   }
@@ -438,7 +438,7 @@ function requireV23Disclosed(tcString, opts) {
         metadata: { policyVersion: parsed.core.policyVersion, required: TCF_V23_POLICY_VERSION },
       });
     }
-    throw IabTcfError.factory("WRONG_POLICY_VERSION",
+    throw IabTcfError.factory("iab-tcf/wrong-policy-version",
       "iabTcf: policy version " + parsed.core.policyVersion + " not v2.3 (required " +
       TCF_V23_POLICY_VERSION + ")");
   }
@@ -451,7 +451,7 @@ function requireV23Disclosed(tcString, opts) {
         metadata: {},
       });
     }
-    throw IabTcfError.factory("MISSING_DISCLOSED_VENDORS",
+    throw IabTcfError.factory("iab-tcf/missing-disclosed-vendors",
       "iabTcf: TC string lacks DisclosedVendors segment (TCF v2.3 §III.B.5 — REQUIRED since 2026-02-28)");
   }
   if (auditOn) {
@@ -492,12 +492,12 @@ function requireV23Disclosed(tcString, opts) {
  */
 function checkVendor(parsed, vendorId) {
   if (!parsed || !parsed.core) {
-    throw IabTcfError.factory("BAD_PARSED",
+    throw IabTcfError.factory("iab-tcf/bad-parsed",
       "iabTcf.checkVendor: parsed object required (call parseString first)");
   }
   if (typeof vendorId !== "number" || !isFinite(vendorId) || vendorId < 1 ||
       Math.floor(vendorId) !== vendorId) {
-    throw IabTcfError.factory("BAD_VENDOR_ID",
+    throw IabTcfError.factory("iab-tcf/bad-vendor-id",
       "iabTcf.checkVendor: vendorId must be a positive integer");
   }
   return {
@@ -522,7 +522,7 @@ function _idArray(x) {
   var out = [];
   list.forEach(function (id) {
     if (typeof id !== "number" || !isFinite(id) || id < 1 || Math.floor(id) !== id) {
-      throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: vendor/purpose ids must be positive integers, got " + id);
+      throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: vendor/purpose ids must be positive integers, got " + id);
     }
     if (!seen[id]) { seen[id] = 1; out.push(id); }
   });
@@ -544,7 +544,7 @@ function _idRuns(ids) {
 
 function _decisec(t) {
   var ms = t instanceof Date ? t.getTime() : (t == null ? Date.now() : Number(t));
-  if (!isFinite(ms) || ms < 0) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: timestamp must be a Date or non-negative epoch-ms");
+  if (!isFinite(ms) || ms < 0) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: timestamp must be a Date or non-negative epoch-ms");
   return Math.round(ms / 100);                                                                  // allow:raw-time-literal — ms → TCF deciseconds
 }
 
@@ -554,8 +554,8 @@ function _decisec(t) {
 function _bitWriter() {
   var bits = "";
   function writeInt(v, n) {
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: expected a non-negative integer, got " + v);
-    if (v >= Math.pow(2, n)) throw IabTcfError.factory("VALUE_OVERFLOW", "iabTcf.encode: " + v + " does not fit in " + n + " bits");
+    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: expected a non-negative integer, got " + v);
+    if (v >= Math.pow(2, n)) throw IabTcfError.factory("iab-tcf/value-overflow", "iabTcf.encode: " + v + " does not fit in " + n + " bits");
     bits += v.toString(2).padStart(n, "0");
   }
   function writeBool(flag) { bits += flag ? "1" : "0"; }
@@ -601,10 +601,10 @@ function _b64urlEncode(buf) {
 
 function _writeLetters(w, s, label) {
   var str = String(s).toUpperCase();
-  if (str.length !== 2) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: " + label + " must be a 2-letter code, got '" + s + "'");
+  if (str.length !== 2) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: " + label + " must be a 2-letter code, got '" + s + "'");
   for (var i = 0; i < 2; i += 1) {
     var v = str.charCodeAt(i) - 0x41;                                                           // allow:raw-byte-literal — ASCII 'A' offset
-    if (v < 0 || v > 25) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: '" + str.charAt(i) + "' is not an A-Z letter");
+    if (v < 0 || v > 25) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: '" + str.charAt(i) + "' is not an A-Z letter");
     w.writeInt(v, 6);                                                                           // allow:raw-byte-literal — TCF spec field width
   }
 }
@@ -650,7 +650,7 @@ function _encodePublisherTC(pub) {
  */
 function encode(obj) {
   if (!obj || typeof obj !== "object" || !obj.core || typeof obj.core !== "object") {
-    throw IabTcfError.factory("BAD_INPUT", "iabTcf.encode: obj must have a 'core' object");
+    throw IabTcfError.factory("iab-tcf/bad-input", "iabTcf.encode: obj must have a 'core' object");
   }
   var c = obj.core;
   var w = _bitWriter();

package/lib/mcp.js

@@ -81,30 +81,30 @@ function parseRequest(body, opts) {
   try {
     parsed = typeof body === "string" ? safeJson.parse(body, { maxBytes: C.BYTES.mib(1) }) : body;                                  // allow:JSON.parse — routed via safeJson.parse
   } catch (_e) {
-    throw errorClass.factory("BAD_JSON",
+    throw errorClass.factory("mcp/bad-json",
       "mcp.parseRequest: body is not valid JSON");
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw errorClass.factory("BAD_ENVELOPE",
+    throw errorClass.factory("mcp/bad-envelope",
       "mcp.parseRequest: request must be a JSON-RPC object");
   }
   if (parsed.jsonrpc !== "2.0") {
-    throw errorClass.factory("BAD_VERSION",
+    throw errorClass.factory("mcp/bad-version",
       "mcp.parseRequest: jsonrpc must be \"2.0\"");
   }
   if (typeof parsed.method !== "string" || parsed.method.length === 0 ||
       parsed.method.length > METHOD_NAME_MAX) {
-    throw errorClass.factory("BAD_METHOD",
+    throw errorClass.factory("mcp/bad-method",
       "mcp.parseRequest: method must be a non-empty string under 256 bytes");
   }
   if (parsed.id !== undefined && parsed.id !== null &&
       typeof parsed.id !== "string" && typeof parsed.id !== "number") {
-    throw errorClass.factory("BAD_ID",
+    throw errorClass.factory("mcp/bad-id",
       "mcp.parseRequest: id must be string, number, or null");
   }
   if (parsed.params !== undefined && parsed.params !== null &&
       typeof parsed.params !== "object") {
-    throw errorClass.factory("BAD_PARAMS",
+    throw errorClass.factory("mcp/bad-params",
       "mcp.parseRequest: params must be object or array");
   }
   return parsed;
@@ -167,7 +167,7 @@ function _readBodyBuffered(req, maxBytes, errorClass) {
       try { collector.push(chunk); }
       catch (_e) {
         req.destroy();
-        reject(errorClass.factory("BODY_TOO_LARGE",
+        reject(errorClass.factory("mcp/body-too-large",
           "mcp: request body exceeds " + maxBytes + " bytes"));
       }
     });
@@ -178,17 +178,17 @@ function _readBodyBuffered(req, maxBytes, errorClass) {
 
 function _checkRedirectUri(uri, allowlist, errorClass) {
   if (typeof uri !== "string") {
-    throw errorClass.factory("BAD_REDIRECT_URI",
+    throw errorClass.factory("mcp/bad-redirect-uri",
       "mcp: redirect_uri must be a string");
   }
   if (!Array.isArray(allowlist) || allowlist.indexOf(uri) === -1) {
-    throw errorClass.factory("REDIRECT_URI_REFUSED",
+    throw errorClass.factory("mcp/redirect-uri-refused",
       "mcp: redirect_uri not in allowlist (OAuth 2.1 / RFC 9700 sec 4.1.1)");
   }
   var parsed;
   try { parsed = safeUrl.parse(uri); }
   catch (_e) {
-    throw errorClass.factory("BAD_REDIRECT_URI",
+    throw errorClass.factory("mcp/bad-redirect-uri",
       "mcp: redirect_uri did not parse");
   }
   var isHttps = parsed.protocol === "https:";
@@ -205,7 +205,7 @@ function _checkRedirectUri(uri, allowlist, errorClass) {
   }
   var isLocal = rawHost === "localhost" || rawHost === "127.0.0.1" || rawHost === "::1";
   if (!isHttps && !isLocal) {
-    throw errorClass.factory("INSECURE_REDIRECT_URI",
+    throw errorClass.factory("mcp/insecure-redirect-uri",
       "mcp: redirect_uri must be HTTPS (or localhost; RFC 9700 sec 4.1.1)");
   }
 }
@@ -257,7 +257,7 @@ function serverGuard(opts) {
   var requireBearer = opts.requireBearer !== false;
   var verifyBearer  = opts.verifyBearer || null;
   if (requireBearer && typeof verifyBearer !== "function") {
-    throw errorClass.factory("BAD_OPTS",
+    throw errorClass.factory("mcp/bad-opts",
       "mcp.serverGuard: verifyBearer required when requireBearer=true");
   }
   var redirectUriAllowlist = Array.isArray(opts.redirectUriAllowlist)
@@ -266,7 +266,7 @@ function serverGuard(opts) {
   var registerClientAllowlist = typeof opts.registerClientAllowlist === "function"
     ? opts.registerClientAllowlist : null;
   if (allowDynamicRegister && !registerClientAllowlist) {
-    throw errorClass.factory("BAD_OPTS",
+    throw errorClass.factory("mcp/bad-opts",
       "mcp.serverGuard: allowDynamicRegister=true requires registerClientAllowlist function");
   }
   var toolAllowlist     = Array.isArray(opts.toolAllowlist)     ? opts.toolAllowlist     : null;

package/lib/middleware/require-step-up.js

@@ -123,11 +123,11 @@ function create(opts) {
   ], "middleware.requireStepUp");
 
   if (!opts.requirement || typeof opts.requirement !== "object") {
-    throw new AuthError("auth-stepUp/bad-requirement",
+    throw new AuthError("auth-step-up/bad-requirement",
       "middleware.requireStepUp: opts.requirement must be an object");
   }
   validateOpts.optionalFunction(opts.getClaims,
-    "middleware.requireStepUp: getClaims", AuthError, "auth-stepUp/bad-opt");
+    "middleware.requireStepUp: getClaims", AuthError, "auth-step-up/bad-opt");
 
   var realm        = (typeof opts.realm === "string" && opts.realm.length > 0)
     ? opts.realm : "api";
@@ -146,7 +146,7 @@ function create(opts) {
   // on the first hot-path request.
   var probe = stepUp().evaluate({ claims: { acr: "0" }, requirement: opts.requirement });
   if (probe.error === "bad_requirement" || probe.error === "unknown_acr") {
-    throw new AuthError("auth-stepUp/bad-requirement",
+    throw new AuthError("auth-step-up/bad-requirement",
       "middleware.requireStepUp: " + (probe.reason || probe.error));
   }
 

package/lib/sec-cyber.js

@@ -91,13 +91,13 @@ function _addBusinessDays(startMs, days) {
 
 function eightKArtifact(opts) {
   if (!opts || typeof opts !== "object") {
-    throw SecCyberError.factory("BAD_OPTS",
+    throw SecCyberError.factory("sec-cyber/bad-opts",
       "secCyber.eightKArtifact: opts required");
   }
   validateOpts.requireNonEmptyString(opts.incidentId,
     "secCyber.eightKArtifact: incidentId", SecCyberError, "BAD_INCIDENT_ID");
   if (!opts.registrant || typeof opts.registrant !== "object") {
-    throw SecCyberError.factory("BAD_REGISTRANT",
+    throw SecCyberError.factory("sec-cyber/bad-registrant",
       "secCyber.eightKArtifact: registrant object required");
   }
   validateOpts.requireNonEmptyString(opts.registrant.name,
@@ -110,7 +110,7 @@ function eightKArtifact(opts) {
     "secCyber.eightKArtifact: materialityDeterminedAt", SecCyberError, "BAD_MAT_AT");
 
   if (FINDINGS.indexOf(opts.materialityFinding) === -1) {
-    throw SecCyberError.factory("BAD_FINDING",
+    throw SecCyberError.factory("sec-cyber/bad-finding",
       "secCyber.eightKArtifact: materialityFinding must be one of " + FINDINGS.join(", "));
   }
   validateOpts.requireNonEmptyString(opts.materialityReasoning,

package/lib/sse.js

@@ -89,7 +89,7 @@ function _validateRetry(retry, errorClass) {
   if (retry === undefined || retry === null) return null;
   if (typeof retry !== "number" || !isFinite(retry) || retry < 0 ||
       Math.floor(retry) !== retry) {
-    throw errorClass.factory("BAD_RETRY",
+    throw errorClass.factory("sse/bad-retry",
       "sse.send: retry must be a non-negative finite integer (got " +
       JSON.stringify(retry) + ")");
   }
@@ -98,14 +98,14 @@ function _validateRetry(retry, errorClass) {
 
 function _refuseInjection(field, value, errorClass) {
   if (typeof value !== "string") {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("sse/bad-field",
       "sse.send: " + field + " must be a string");
   }
   // Length-bound BEFORE the regex test — _capField applies a tighter
   // cap further along, but the regex itself runs against the full
   // value so we bound here too.
   if (value.length > MAX_DATA_BYTES) {
-    throw errorClass.factory("FIELD_TOO_LARGE",
+    throw errorClass.factory("sse/field-too-large",
       "sse.send: " + field + " too large for injection scan");
   }
   if (INJECTION_RE.test(value)) {                                                          // allow:regex-no-length-cap — value length capped above
@@ -114,7 +114,7 @@ function _refuseInjection(field, value, errorClass) {
       outcome:  "denied",
       metadata: { field: field, length: value.length },
     });
-    throw errorClass.factory("INJECTION",
+    throw errorClass.factory("sse/injection",
       "sse.send: " + field + " contains LF/CR/NUL — refused " +
       "(CVE-2026-33128 / 29085 / 44217 class)");
   }
@@ -130,7 +130,7 @@ var MAX_DATA_BYTES  = C.BYTES.mib(1);
 function _capField(field, value, capBytes, errorClass) {
   var len = Buffer.byteLength(value, "utf8");
   if (len > capBytes) {
-    throw errorClass.factory("FIELD_TOO_LARGE",
+    throw errorClass.factory("sse/field-too-large",
       "sse.send: " + field + " exceeds cap (" + len + " > " +
       capBytes + " bytes)");
   }
@@ -139,7 +139,7 @@ function _capField(field, value, capBytes, errorClass) {
 function serializeEvent(opts, errorClass) {
   errorClass = errorClass || SseError;
   if (!opts || typeof opts !== "object") {
-    throw errorClass.factory("BAD_OPTS", "sse.serializeEvent: opts required");
+    throw errorClass.factory("sse/bad-opts", "sse.serializeEvent: opts required");
   }
   var out = "";
   // Field order: id, event, retry, data — matches the framework's
@@ -162,7 +162,7 @@ function serializeEvent(opts, errorClass) {
   }
   if (opts.data !== undefined && opts.data !== null) {
     if (typeof opts.data !== "string") {
-      throw errorClass.factory("BAD_FIELD",
+      throw errorClass.factory("sse/bad-field",
         "sse.send: data must be a string");
     }
     _capField("data", opts.data, MAX_DATA_BYTES, errorClass);
@@ -174,7 +174,7 @@ function serializeEvent(opts, errorClass) {
         outcome:  "denied",
         metadata: { field: "data", length: opts.data.length, char: "cr-or-nul" },
       });
-      throw errorClass.factory("INJECTION",
+      throw errorClass.factory("sse/injection",
         "sse.send: data contains CR or NUL — refused");
     }
     var lines = opts.data.split("\n");
@@ -189,11 +189,11 @@ function serializeEvent(opts, errorClass) {
 
 function _validateComment(text, errorClass) {
   if (typeof text !== "string") {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("sse/bad-field",
       "sse.comment: text must be a string");
   }
   if (text.length > MAX_DATA_BYTES) {
-    throw errorClass.factory("FIELD_TOO_LARGE",
+    throw errorClass.factory("sse/field-too-large",
       "sse.comment: text too large for injection scan");
   }
   if (INJECTION_RE.test(text)) {                                                            // allow:regex-no-length-cap — text length capped above
@@ -202,7 +202,7 @@ function _validateComment(text, errorClass) {
       outcome:  "denied",
       metadata: { field: "comment", length: text.length },
     });
-    throw errorClass.factory("INJECTION",
+    throw errorClass.factory("sse/injection",
       "sse.comment: text contains LF/CR/NUL — refused");
   }
 }
@@ -224,14 +224,14 @@ function create(req, res, opts) {
   opts = opts || {};
   var errorClass = opts.errorClass || SseError;
   if (!res || typeof res.write !== "function" || typeof res.end !== "function") {
-    throw errorClass.factory("BAD_RES",
+    throw errorClass.factory("sse/bad-res",
       "sse.create: res must be a writable response stream");
   }
   var heartbeatMs = opts.heartbeatMs;
   if (heartbeatMs === undefined) heartbeatMs = C.TIME.seconds(15);
   if (typeof heartbeatMs !== "number" || !isFinite(heartbeatMs) ||
       heartbeatMs < 0 || Math.floor(heartbeatMs) !== heartbeatMs) {
-    throw errorClass.factory("BAD_OPTS",
+    throw errorClass.factory("sse/bad-opts",
       "sse.create: heartbeatMs must be a non-negative integer ms (got " +
       JSON.stringify(heartbeatMs) + ")");
   }
@@ -264,7 +264,7 @@ function create(req, res, opts) {
 
   function _writeRaw(s) {
     if (closed) {
-      throw errorClass.factory("CLOSED",
+      throw errorClass.factory("sse/closed",
         "sse.send: channel closed");
     }
     res.write(s);

package/lib/tcpa-10dlc.js

@@ -72,11 +72,11 @@ var records = new Map();   // phoneE164 → record
 
 function recordConsent(opts) {
   if (!opts || typeof opts !== "object") {
-    throw Tcpa10dlcError.factory("BAD_OPTS",
+    throw Tcpa10dlcError.factory("tcpa-10dlc/bad-opts",
       "tcpa10dlc.recordConsent: opts required");
   }
   if (typeof opts.phoneE164 !== "string" || !E164_RE.test(opts.phoneE164)) {
-    throw Tcpa10dlcError.factory("BAD_PHONE",
+    throw Tcpa10dlcError.factory("tcpa-10dlc/bad-phone",
       "tcpa10dlc.recordConsent: phoneE164 must match " + E164_RE);
   }
   validateOpts.requireNonEmptyString(opts.brand,
@@ -86,7 +86,7 @@ function recordConsent(opts) {
   validateOpts.requireNonEmptyString(opts.formUrl,
     "tcpa10dlc.recordConsent: formUrl", Tcpa10dlcError, "BAD_FORM_URL");
   if (DISCLOSURE_PARTIES.indexOf(opts.disclosurePartyKind) === -1) {
-    throw Tcpa10dlcError.factory("BAD_DISCLOSURE_PARTY",
+    throw Tcpa10dlcError.factory("tcpa-10dlc/bad-disclosure-party",
       "tcpa10dlc.recordConsent: disclosurePartyKind must be one of " +
       DISCLOSURE_PARTIES.join(", "));
   }
@@ -133,12 +133,12 @@ function lookup(phoneE164) {
 
 function revoke(phoneE164, reason) {
   if (typeof phoneE164 !== "string" || !E164_RE.test(phoneE164)) {
-    throw Tcpa10dlcError.factory("BAD_PHONE",
+    throw Tcpa10dlcError.factory("tcpa-10dlc/bad-phone",
       "tcpa10dlc.revoke: phoneE164 must match " + E164_RE);
   }
   var existing = records.get(phoneE164);
   if (!existing) {
-    throw Tcpa10dlcError.factory("NO_RECORD",
+    throw Tcpa10dlcError.factory("tcpa-10dlc/no-record",
       "tcpa10dlc.revoke: no consent record for " + phoneE164);
   }
   if (existing.revoked) {