@shipstatic/types 2.5.0-beta.13 → 2.5.0-beta.14

package/dist/index.js

@@ -214,6 +214,14 @@ const ERROR_CATEGORIES = {
  * `ErrorType` is automatically picked up.
  */
 const SERVER_PRODUCIBLE_ERROR_TYPES = new Set(Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)));
+/**
+ * Ceiling on a message adopted from a **non-JSON** error body — a foreign
+ * responder's, never this platform's. Generous for the plain-text one-liners
+ * intermediaries actually send (`error code: 1015`), far below a document.
+ * Our own messages are never measured against it: a JSON body is the API's
+ * contract, and truncating a long validation message would be the bug.
+ */
+const MAX_FOREIGN_MESSAGE_LENGTH = 200;
 /**
  * Simple unified error class for both API and SDK
  */
@@ -285,9 +293,17 @@ export class ShipError extends Error {
                 }
             }
             else {
-                const text = await response.text();
-                if (text)
+                // A non-JSON body did not come from this platform — every API error
+                // is `ErrorResponse` JSON — so it is an intermediary's output, and
+                // the two kinds it produces need opposite treatment. A CDN's plain
+                // `error code: 1015` is the most useful thing there is to say. A
+                // proxy's HTML error page is a *document*, not a message: adopting it
+                // verbatim made a misconfigured `apiUrl` print 2,059 characters of
+                // markup as the error. Trust it only when it reads as a message.
+                const text = (await response.text()).trim();
+                if (text && !text.startsWith('<') && text.length <= MAX_FOREIGN_MESSAGE_LENGTH) {
                     message = text;
+                }
             }
         }
         catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "2.5.0-beta.13",
+  "version": "2.5.0-beta.14",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -702,6 +702,15 @@ const SERVER_PRODUCIBLE_ERROR_TYPES = new Set<string>(
   Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)),
 );
 
+/**
+ * Ceiling on a message adopted from a **non-JSON** error body — a foreign
+ * responder's, never this platform's. Generous for the plain-text one-liners
+ * intermediaries actually send (`error code: 1015`), far below a document.
+ * Our own messages are never measured against it: a JSON body is the API's
+ * contract, and truncating a long validation message would be the bug.
+ */
+const MAX_FOREIGN_MESSAGE_LENGTH = 200;
+
 /**
  * Standard error response format used everywhere
  */
@@ -788,8 +797,17 @@ export class ShipError extends Error {
           }
         }
       } else {
-        const text = await response.text();
-        if (text) message = text;
+        // A non-JSON body did not come from this platform — every API error
+        // is `ErrorResponse` JSON — so it is an intermediary's output, and
+        // the two kinds it produces need opposite treatment. A CDN's plain
+        // `error code: 1015` is the most useful thing there is to say. A
+        // proxy's HTML error page is a *document*, not a message: adopting it
+        // verbatim made a misconfigured `apiUrl` print 2,059 characters of
+        // markup as the error. Trust it only when it reads as a message.
+        const text = (await response.text()).trim();
+        if (text && !text.startsWith('<') && text.length <= MAX_FOREIGN_MESSAGE_LENGTH) {
+          message = text;
+        }
       }
     } catch {
       // Body unreadable; fall through to operationName-derived message.