[btopro]

Part of haxtheweb/issues#3157. Merge this one first: it holds the shared code list the backend PRs copy. It also works on its own with today's backends (no codes yet → the English message is shown as before, and the registry fix below already helps).

What it touches

• haxcms-elements/lib/haxcms-api-codes.json (new, source of truth): 117 message codes, each with English text and the patterns the backends use to recognise the messages they already send (named groups become params, e.g. {maxMb}). Covers 1,166 of the 1,171 response messages surveyed across both backends.
• haxcms-elements/locales/haxcms-api.<lang>.json: 102 languages, plus the manifest entry.
• haxcms-elements/lib/core/utils/HAXCMSApiMessages.js (new): haxcmsApiMessage(response, fallback).
  • The user's language has a translation → show it.
  • English, or no translation, or a param is missing → show the server's English message, which is often more specific (it names the page or route).
  • Also exposed as globalThis.haxcmsApiMessage for hax-body, which can't import haxcms-elements.
• Used in: site editor request errors and page details, files dialog, file actions (hax-upload-field), Excel import, archive export, app-hax site actions, site creation errors, system settings.
• micro-frontend-registry fix: error results only read a top-level message, but both backends put it in data.message (or data.error), so most backend error text never reached people. It now reads those and keeps code/params.
• AppHaxBackendAPI: hard-denial detection uses ACCESS_DENIED / USER_TOKEN_REQUIRED, keeping the English list for older backends. Because of the registry fix, these denials are actually detected now. Before, they always went down the token-refresh path.
• Editor _responseStatusText: the backend message now wins over an HTTP reason phrase like "Bad Request" (the direct-fetch path set statusText from HTTP, which hid the real message).

Tests

• New haxcms-elements/test/haxcms-api-messages.test.js:
  • English text matches the locale file and the code list.
  • Every translation has all keys and the same placeholders.
  • Response shapes, translation vs. English fallback, missing params.
• micro-frontend-registry tests cover the envelope message and code.
• Locally, app-hax + haxcms-elements + upload tests pass: 1,289 tests across 36 files.

Translation confidence

Lower confidence; worth a native speaker's look: co, eu, fo, fy, ga, gn, ha, haw, ig, jv, km, kn, ku, ky, lb, lo, mi, ml, my, ny, om, pa, pnb, ps, qu, sd, si, sn, so, tg, tk, tt, wuu, xh, yi, yo, zu.

Related PRs, in merge order

1. this PR
2. haxcms-nodejs and haxcms-php: send the codes (either order)
3. create: shows translated messages in the CLI. Needs a haxcms-nodejs release that bundles this build.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
webcomponents	Error		Oct 19, 2026 5:30pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.