@zeropress/build-core 0.7.1 → 0.7.4

package/README.md

@@ -121,6 +121,9 @@ Loads a theme directory from disk and renders it using the same core pipeline.
 
 This is useful for local tooling that wants filesystem theme loading but still uses the same deterministic core renderer.
 
+Theme validation failures from either build entry point carry `error.code === 'THEME_VALIDATION_FAILED'`.
+Their messages preserve report and hint line breaks while escaping terminal control characters in diagnostic values such as paths, messages, and source snippets. CLI consumers can preserve the layout of these reports while escaping arbitrary errors as single-line text.
+
 ## Writers
 
 ### `MemoryWriter`
@@ -165,13 +168,13 @@ Theme validation is enforced through:
 
 `buildSiteFromThemeDir()` is the convenience entry point that loads a theme directory and converts it into the required in-memory `themePackage`.
 
-Theme packages use fixed safety limits shared with `@zeropress/theme-validator`: at most 128 entries, 1 MiB per file, and 4 MiB in total expanded content. `buildSiteFromThemeDir()` normalizes equivalent spellings such as `theme`, `theme/`, and `theme/.` before checking the final entry, requires that final entry to be real rather than a symbolic link, pins an accepted root to its canonical path, checks filesystem sizes before reading file bodies, and rejects every symbolic link inside the root, including links that stay inside the theme directory and dangling links. Symbolic links in ancestor path components are allowed. Package paths reject literal backslashes and exact empty, `.` or `..` segments while ordinary filenames such as `name..txt` remain valid. Directory entries that collide after NFC and case normalization are also rejected so directory and ZIP adapters use the same cross-platform identity. `buildSite()` validates the same limits for an already-loaded in-memory package. Packaged ZIP input is handled by `@zeropress/theme`, which additionally limits the archive itself to 2 MiB.
+Theme packages use fixed safety limits shared with `@zeropress/theme-validator`: at most 128 entries, 1 MiB per file, and 4 MiB in total content. `buildSiteFromThemeDir()` normalizes equivalent spellings such as `theme`, `theme/`, and `theme/.` before checking the final entry, requires that final entry to be real rather than a symbolic link, pins an accepted root to its canonical path, checks filesystem sizes before reading file bodies, and rejects every symbolic link inside the root, including links that stay inside the theme directory and dangling links. Symbolic links in ancestor path components are allowed. Package paths reject literal backslashes and exact empty, `.` or `..` segments while ordinary filenames such as `name..txt` remain valid. Directory entries that collide after NFC and case normalization are rejected so every package has one cross-platform path identity. `buildSite()` validates the same limits for an already-loaded in-memory package.
 
 Theme CSS and JavaScript assets are emitted byte-for-byte as provided. `custom_css.content` is checked for nonblank content but otherwise retains its original whitespace, comments, strings, and syntax. Build Core may hash output filenames; every hash is computed from the bytes actually emitted, and Build Core does not rewrite or minify CSS or JavaScript. Both `.js` and `.mjs` outputs use a JavaScript MIME type.
 
 User-defined scalar metadata under `site.meta`, `post.meta`, `page.meta`, and item `meta` is always HTML-escaped during template interpolation. Names ending in `_html` or `_url` do not opt metadata into raw rendering; use the explicit content and custom HTML contracts for trusted raw markup.
 
-Post/Page HTML, Markdown raw HTML, and text-widget HTML pass through a parser-based explicit allowlist. Safe structural, media, table, task-list, and alert markup is retained; event handlers and unsafe URL schemes are removed. Links permit relative URLs, HTTP(S), `mailto:`, and `tel:`. Media and iframe URLs permit relative URLs or HTTP(S), and protocol-relative URLs are rejected. Each `srcset` candidate is checked independently. This sanitizer boundary does not include trusted `custom_html` slots or `standalone_html`, which remain intentionally unchanged.
+Post/Page HTML, Markdown raw HTML, and text-widget HTML pass through a parser-based explicit allowlist. Safe structural, media, table, task-list, and alert markup is retained; event handlers and unsafe URL schemes are removed. Inline presentation is limited to `text-align: left | center | right | justify` on paragraphs/headings and bounded CSS `color` values on spans; every other inline style is removed. Links permit relative URLs, HTTP(S), `mailto:`, and `tel:`. Media and iframe URLs permit relative URLs or HTTP(S), and protocol-relative URLs are rejected. Each `srcset` candidate is checked independently. This sanitizer boundary does not include trusted `custom_html` slots or `standalone_html`, which remain intentionally unchanged.
 
 Build-core derives:
 
@@ -182,8 +185,22 @@ Build-core derives:
 - localized fallback `published_at` / `updated_at` values plus unconditional `published_at_iso` / `updated_at_iso` values
 - datetime formatting from `site.locale`, `site.timezone`, `site.date_style`, and `site.time_style`
 - `reading_time`
+- effective `post.summary` and `page.summary` values for theme listings and metadata
 - a route-root `comments` discriminated context
 
+### Authored excerpts and runtime summaries
+
+Preview Data `post.excerpt` and `page.excerpt` are authored values. Build Core does not replace them with body text; an omitted Page excerpt becomes `""` in the runtime context. It derives a separate `summary` once from each prepared Post or Page:
+
+- a trim-nonempty authored excerpt becomes the summary after trimming only its outer whitespace, without a length limit
+- otherwise, Build Core uses visible text from the rendered HTML, removes comments and non-visible `script`, `style`, `template`, and `noscript` content, removes a leading H1 when it matches the document title, decodes entities, and collapses whitespace
+- a derived body summary is at most 160 Unicode code points, including a final `…` when truncated
+- a document with no displayable text has `summary: ""`
+
+Both fields are available on detail Post/Page contexts. The same precomputed summary is propagated to `posts.items[]`, archive and taxonomy items, Post/Page collection items, collection cursor `prev`/`next` items, and `post.prev`/`post.next`. Themes should use `summary` for optional list/card copy and retain `excerpt` for an explicitly authored detail lede.
+
+Post/Page metadata descriptions use `summary`; ordinary detail routes do not fall back to `site.description`. A Page used as the front page uses `site.description` only when neither an authored nor body-derived summary exists. RSS item descriptions use Post summaries. Native/Pagefind search continues to index the authored excerpt separately and creates a query-specific body excerpt when needed; it does not substitute the general runtime summary. User-defined `meta.description` keys remain ordinary generator/theme metadata and receive no special Build Core interpretation.
+
 Every ordinary rendered route receives effective feature state on `site`, regardless of whether the corresponding Preview Data preference was omitted:
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeropress/build-core",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "description": "Shared ZeroPress build core",
   "type": "module",
   "license": "MIT",
@@ -30,15 +30,15 @@
     "test": "node --test"
   },
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.22.0"
   },
   "dependencies": {
-    "@zeropress/slug-policy": "0.2.1",
-    "@zeropress/preview-data-validator": "0.7.1",
-    "@zeropress/theme-validator": "0.7.1",
-    "highlight.js": "11.11.1",
-    "markdown-it": "14.3.0",
-    "markdown-it-anchor": "9.2.1",
-    "sanitize-html": "2.17.6"
+    "@zeropress/slug-policy": "0.2.2",
+    "@zeropress/preview-data-validator": "0.7.3",
+    "@zeropress/theme-validator": "0.7.3",
+    "highlight.js": "11.12.0",
+    "markdown-it": "15.0.2",
+    "markdown-it-anchor": "10.0.0",
+    "sanitize-html": "2.17.7"
   }
 }

package/src/api/build-site.js

@@ -2,9 +2,10 @@ import { createHash } from 'node:crypto';
 import { assertPreviewData } from '@zeropress/preview-data-validator';
 import { isSafeSlugSegment, normalizeStoredSlug } from '@zeropress/slug-policy';
 import { validateThemeFiles } from '@zeropress/theme-validator';
+import sanitizeHtml from 'sanitize-html';
 import { AssetProcessor } from '../assets/asset-processor.js';
 import { renderDocument, renderDocumentContent } from '../render/content-renderer.js';
-import { formatThemeValidationFailure } from '../theme/format-theme-validation.js';
+import { createThemeValidationError } from '../theme/format-theme-validation.js';
 import { ZeroPressEngine } from '../render/zeropress-engine.js';
 
 const DEFAULT_OPTIONS = {
@@ -52,6 +53,8 @@ const SAFE_LINK_PROTOCOLS = new Set(['http:', 'https:']);
 const MEDIA_DELIVERY_MODES = new Set(['none', 'media_domain']);
 const DISCOVERABILITY_VALUES = new Set(['default', 'noindex', 'delist']);
 const CUSTOM_HTML_SLOT_MAX_CODE_POINTS = 65_536;
+const GENERATED_SUMMARY_MAX_CODE_POINTS = 160;
+const SUMMARY_TEXT_BOUNDARY_TAG_PATTERN = /<\/?(?:h[1-6]|p|br|hr|pre|ul|ol|li|blockquote|aside|figure|figcaption|table|thead|tbody|tfoot|tr|th|td|div|nav)\b[^>]*>/gi;
 const HEAD_CLOSING_TAG_PATTERN = /<\/head\s*>/i;
 const BODY_CLOSING_TAG_PATTERN = /<\/body\s*>/i;
 const RESPONSIVE_IMAGE_WIDTHS = [320, 480, 768, 1024, 1280, 1600, 1920];
@@ -261,6 +264,7 @@ async function renderFrontPage(state, route) {
       ...route.page,
       url: currentUrl,
     };
+    const description = page.summary || state.previewData.site.description;
     let html = await state.engine.render(
       'page',
       {
@@ -273,7 +277,7 @@ async function renderFrontPage(state, route) {
         meta: buildPageMeta(state.previewData.site, {
           currentUrl,
           title: buildFrontPageTitle(state.previewData.site),
-          description: page.excerpt,
+          description,
           ogType: 'website',
           image: page.featured_image,
           robotsNoindex: shouldNoindexDocument(page),
@@ -294,7 +298,7 @@ async function renderFrontPage(state, route) {
     state.emitted.frontPage = {
       url: currentUrl,
       title: page.title,
-      description: page.excerpt,
+      description,
       updatedAt: page.updated_at_iso,
       includeInFeed: false,
       includeInSitemap: !isDelistedDocument(page),
@@ -349,7 +353,7 @@ async function renderPost(state, post) {
       meta: buildPageMeta(state.previewData.site, {
         currentUrl,
         title: buildDocumentTitle(post.title, state.previewData.site.title),
-        description: post.excerpt,
+        description: post.summary,
         ogType: 'article',
         image: post.featured_image,
         publishedTime: post.published_at_iso,
@@ -373,7 +377,7 @@ async function renderPost(state, post) {
     state.emitted.posts.push({
       url: currentUrl,
       title: post.title,
-      description: post.excerpt,
+      description: post.summary,
       publishedAt: post.published_at_iso,
       updatedAt: post.updated_at_iso,
       status: post.status,
@@ -398,7 +402,7 @@ async function renderPage(state, page) {
         currentUrl,
         canonicalUrl,
         title: buildDocumentTitle(page.title, state.previewData.site.title),
-        description: page.excerpt,
+        description: page.summary,
         ogType: 'website',
         image: page.featured_image,
         robotsNoindex: shouldNoindexDocument(page),
@@ -419,7 +423,7 @@ async function renderPage(state, page) {
   state.emitted.pages.push({
     url: currentUrl,
     title: page.title,
-    description: page.excerpt,
+    description: page.summary,
     updatedAt: page.updated_at_iso,
     status: page.status,
     includeInSitemap: page.omit_from_sitemap !== true && !isDelistedDocument(page),
@@ -1291,6 +1295,7 @@ function buildCollectionPageSummary(page, frontPage, pageReferencePath) {
     slug: page.slug,
     url: frontPage?.type === 'page' && frontPage.page_path === pageReferencePath ? '/' : page.url,
     excerpt: page.excerpt || '',
+    summary: page.summary || '',
     featured_image: page.featured_image || '',
     updated_at: page.updated_at || '',
     updated_at_iso: page.updated_at_iso || '',
@@ -1348,6 +1353,7 @@ function buildCollectionCursorItemSummary(item) {
     slug: item.slug,
     url: item.url,
     excerpt: item.excerpt || '',
+    summary: item.summary || '',
     featured_image: item.featured_image || '',
     updated_at: item.updated_at || '',
     updated_at_iso: item.updated_at_iso || '',
@@ -1681,12 +1687,15 @@ function preparePage(page, site) {
   const renderedDocument = renderDocument(page.content, documentType);
   const permalink = resolvePagePermalink(site, page);
   const pageFields = { ...page };
+  const excerpt = typeof page.excerpt === 'string' ? page.excerpt : '';
   delete pageFields.comments;
 
   return {
     ...pageFields,
     url: permalink.url,
     document_type: documentType,
+    excerpt,
+    summary: buildDocumentSummary(excerpt, renderedDocument.html, page.title),
     html: renderedDocument.html,
     toc: renderedDocument.toc,
     updated_at: page.updated_at_iso ? formatTimestamp(page.updated_at_iso, site) : '',
@@ -1696,6 +1705,7 @@ function preparePage(page, site) {
 function preparePost(post, site, authorsById, categoriesBySlug, tagsBySlug) {
   const documentType = normalizeDocumentType(post.document_type);
   const renderedDocument = renderDocument(post.content, documentType);
+  const excerpt = typeof post.excerpt === 'string' ? post.excerpt : '';
   const author = authorsById.get(post.author_id);
   const permalink = resolvePermalink(site, 'posts', post);
   const categories = post.category_slugs
@@ -1722,7 +1732,8 @@ function preparePost(post, site, authorsById, categoriesBySlug, tagsBySlug) {
     url: permalink.url,
     content: post.content,
     document_type: documentType,
-    excerpt: post.excerpt,
+    excerpt,
+    summary: buildDocumentSummary(excerpt, renderedDocument.html, post.title),
     published_at_iso: post.published_at_iso,
     updated_at_iso: post.updated_at_iso,
     author_id: post.author_id,
@@ -1964,6 +1975,7 @@ function buildStructuredPostSummary(post) {
     slug: post.slug,
     url: post.url,
     excerpt: post.excerpt,
+    summary: post.summary,
     published_at: post.published_at,
     published_at_iso: post.published_at_iso,
     reading_time: post.reading_time,
@@ -1991,6 +2003,7 @@ function buildAdjacentPostSummary(post) {
     slug: post.slug,
     url: post.url,
     excerpt: post.excerpt,
+    summary: post.summary,
     published_at: post.published_at,
     published_at_iso: post.published_at_iso,
     data: post.data,
@@ -2235,7 +2248,7 @@ async function normalizeAndValidateThemePackage(themePackage) {
 
   const validation = await validateThemeFiles(fileMap);
   if (!validation.ok) {
-    throw new Error(formatThemeValidationFailure(validation));
+    throw createThemeValidationError(validation);
   }
 
   if (!validation.manifest) {
@@ -3187,6 +3200,63 @@ function buildSearchPageItem(page, url, pageReferencePath) {
   };
 }
 
+function buildDocumentSummary(excerpt, html, title) {
+  const authoredExcerpt = String(excerpt || '').trim();
+  if (authoredExcerpt) {
+    return authoredExcerpt;
+  }
+
+  const visibleText = htmlToSummaryText(html, title);
+  const codePoints = [...visibleText];
+  if (codePoints.length <= GENERATED_SUMMARY_MAX_CODE_POINTS) {
+    return visibleText;
+  }
+
+  const truncated = codePoints
+    .slice(0, GENERATED_SUMMARY_MAX_CODE_POINTS - 1)
+    .join('')
+    .trimEnd();
+  return `${truncated}…`;
+}
+
+function htmlToSummaryText(html, title) {
+  let source = removeNonVisibleSummaryHtml(html);
+  const leadingHeading = source.match(/<h1\b[^>]*>([\s\S]*?)<\/h1\s*>/i);
+  if (
+    leadingHeading
+    && htmlFragmentToSummaryText(source.slice(0, leadingHeading.index)) === ''
+    && normalizeComparableSummaryText(htmlFragmentToSummaryText(leadingHeading[1]))
+      === normalizeComparableSummaryText(title)
+  ) {
+    source = source.slice(0, leadingHeading.index)
+      + source.slice(leadingHeading.index + leadingHeading[0].length);
+  }
+
+  return htmlFragmentToSummaryText(source);
+}
+
+function removeNonVisibleSummaryHtml(html) {
+  return String(html || '')
+    .replace(/<(script|style|template|noscript)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ')
+    .replace(/<!--[\s\S]*?-->/g, ' ');
+}
+
+function htmlFragmentToSummaryText(html) {
+  const textWithTagBoundaries = String(html || '').replace(SUMMARY_TEXT_BOUNDARY_TAG_PATTERN, ' ');
+  const decodedText = sanitizeHtml(textWithTagBoundaries, {
+    allowedTags: [],
+    allowedAttributes: {},
+    parser: {
+      decodeEntities: true,
+    },
+  });
+  return normalizeSearchText(decodeHtmlEntities(decodedText));
+}
+
+function normalizeComparableSummaryText(value) {
+  return normalizeSearchText(value).normalize('NFC');
+}
+
 function buildSearchHeadings(toc) {
   return Array.isArray(toc)
     ? toc.map((item) => normalizeSearchText(item?.title)).filter(Boolean)

package/src/render/content-renderer.js

@@ -34,6 +34,14 @@ const CONTENT_ALLOWED_TAGS = [
   'iframe', 'input',
 ];
 const CONTENT_ALLOWED_ATTRIBUTES = {
+  h1: ['style'],
+  h2: ['style'],
+  h3: ['style'],
+  h4: ['style'],
+  h5: ['style'],
+  h6: ['style'],
+  p: ['style'],
+  span: ['style'],
   a: ['href', 'title', 'class', 'id', 'target', 'rel'],
   aside: ['role', 'class', 'id'],
   img: ['src', 'srcset', 'sizes', 'alt', 'title', 'class', 'id', 'width', 'height', 'loading', 'decoding'],
@@ -47,6 +55,8 @@ const CONTENT_ALLOWED_ATTRIBUTES = {
   track: ['src', 'kind', 'srclang', 'label', 'default', 'class', 'id'],
   '*': ['class', 'id'],
 };
+const CONTENT_COLOR_STYLE_PATTERN = /^(?:#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})|[a-z]{1,32}|(?:rgb|rgba|hsl|hsla)\((?:[-+.\d%,/\s]|deg|rad|grad|turn)+\))$/i;
+const CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN = /^(?:left|center|right|justify)$/i;
 const CONTENT_SANITIZER_OPTIONS = {
   allowedTags: CONTENT_ALLOWED_TAGS,
   allowedAttributes: CONTENT_ALLOWED_ATTRIBUTES,
@@ -57,9 +67,19 @@ const CONTENT_SANITIZER_OPTIONS = {
   allowedSchemesAppliedToAttributes: ['href', 'src', 'poster'],
   allowProtocolRelative: false,
   allowIframeRelativeUrls: true,
-  parseStyleAttributes: false,
+  allowedStyles: {
+    h1: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h2: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h3: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h4: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h5: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h6: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    p: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    span: { color: [CONTENT_COLOR_STYLE_PATTERN] },
+  },
+  parseStyleAttributes: true,
   selfClosing: ['img', 'br', 'hr', 'input', 'source', 'track'],
-  nonTextTags: ['script', 'style', 'textarea', 'option', 'xmp'],
+  nonTextTags: ['script', 'style', 'template', 'noscript', 'textarea', 'option', 'xmp'],
   transformTags: {
     a: transformAnchor,
     th: transformTableCell,

package/src/theme/format-theme-validation.js

@@ -1,9 +1,17 @@
+const UNSAFE_TERMINAL_CHARACTER_REGEX = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/gu;
+
+export function createThemeValidationError(validation) {
+  return Object.assign(new Error(formatThemeValidationFailure(validation)), {
+    code: 'THEME_VALIDATION_FAILED',
+  });
+}
+
 export function formatThemeValidationFailure(validation) {
   const blocks = [
     [
       'Theme validation failed',
       `Errors: ${validation.errors.length}`,
-      `Checked files: ${validation.checkedFiles}`,
+      `Checked files: ${toTerminalSafeText(validation.checkedFiles)}`,
     ].join('\n'),
     ...validation.errors.map((issue) => formatThemeValidationIssue(issue)),
   ];
@@ -15,32 +23,38 @@ function formatThemeValidationIssue(issue) {
     return 'Reason: Unknown error';
   }
 
-  const lines = [`ERROR ${issue.code || 'THEME_VALIDATION_ERROR'}`];
+  const lines = [`ERROR ${toTerminalSafeText(issue.code || 'THEME_VALIDATION_ERROR')}`];
   const location = splitIssuePath(issue.path);
   if (location.file) {
-    lines.push(`File: ${location.file}`);
+    lines.push(`File: ${toTerminalSafeText(location.file)}`);
   }
   if (location.path) {
-    lines.push(`Path: ${location.path}`);
+    lines.push(`Path: ${toTerminalSafeText(location.path)}`);
   }
   if (Number.isInteger(issue.line) && Number.isInteger(issue.column)) {
     lines.push(`Line: ${issue.line}, Column: ${issue.column}`);
   }
   if (issue.category) {
-    lines.push(`Category: ${issue.category}`);
+    lines.push(`Category: ${toTerminalSafeText(issue.category)}`);
   }
-  lines.push(`Reason: ${issue.message || 'Unknown error'}`);
+  lines.push(`Reason: ${toTerminalSafeText(issue.message || 'Unknown error')}`);
   if (issue.snippet) {
     const lineLabel = Number.isInteger(issue.line) ? String(issue.line) : '';
-    lines.push('', `${lineLabel} | ${issue.snippet.line}`, `${' '.repeat(lineLabel.length)} | ${issue.snippet.pointer}`);
+    lines.push('', `${lineLabel} | ${toTerminalSafeText(issue.snippet.line)}`, `${' '.repeat(lineLabel.length)} | ${toTerminalSafeText(issue.snippet.pointer)}`);
   }
   if (issue.hint) {
-    lines.push('', 'Hint:', issue.hint);
+    lines.push('', 'Hint:', String(issue.hint).split('\n').map(toTerminalSafeText).join('\n'));
   }
 
   return lines.join('\n');
 }
 
+function toTerminalSafeText(value) {
+  return String(value ?? '').replace(UNSAFE_TERMINAL_CHARACTER_REGEX, (character) => (
+    `\\u${character.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')}`
+  ));
+}
+
 function splitIssuePath(issuePath) {
   const normalizedPath = String(issuePath || '');
   if (normalizedPath.startsWith('theme.json.')) {

package/src/theme/load-theme-dir.js

@@ -2,7 +2,7 @@ import {
   validateThemeFiles,
   validateThemePackageLimits,
 } from '@zeropress/theme-validator';
-import { formatThemeValidationFailure } from './format-theme-validation.js';
+import { createThemeValidationError } from './format-theme-validation.js';
 
 const TEXT_FILE_EXTENSIONS = new Set(['.html', '.json', '.css', '.js', '.txt', '.svg', '.xml']);
 
@@ -47,7 +47,7 @@ export async function loadThemePackageFromDir(themeDir) {
     pathEntries: packageState.pathEntries,
   });
   if (!validation.ok) {
-    throw new Error(formatThemeValidationFailure(validation));
+    throw createThemeValidationError(validation);
   }
 
   const rawThemeJson = String(fileMap.get('theme.json'));
@@ -174,7 +174,7 @@ async function readThemeDir(fs, fsConstants, path, rootDir, currentDir, fileMap,
 }
 
 function createThemePathError(code, filePath, message, checkedFiles) {
-  return new Error(formatThemeValidationFailure({
+  return createThemeValidationError({
     errors: [{
       code,
       path: filePath,
@@ -183,7 +183,7 @@ function createThemePathError(code, filePath, message, checkedFiles) {
       category: 'theme_package_paths',
     }],
     checkedFiles,
-  }));
+  });
 }
 
 function assertThemePackageLimits(packageState) {
@@ -194,10 +194,10 @@ function assertThemePackageLimits(packageState) {
     return;
   }
 
-  throw new Error(formatThemeValidationFailure({
+  throw createThemeValidationError({
     errors,
     checkedFiles: packageState.fileSizes.size,
-  }));
+  });
 }
 
 function toUint8Array(value) {