now-sdk query treats HTTP 200 login HTML as JSON and hides authentication failure (SDK 4.11.0)

[csuiter]

Summary

In SDK 4.11.0, Connector.queryTable() treats any HTTP 2xx response as Table API JSON. If an instance or authentication layer returns an HTML login/session page with HTTP 200, the SDK calls response.json() and surfaces an opaque parser error:

SyntaxError: Unexpected token '<', "<html><bod"... is not valid JSON

This is difficult to diagnose in CI and scheduled automation because it looks like malformed instance data rather than an expired session or unexpected authentication response.

Environment

• @servicenow/sdk: 4.11.0
• Node.js: 26.6.0
• macOS arm64
• Reproduced without instance credentials using an isolated local HTTP server

Minimal reproduction

import http from 'node:http'
import { Connector, LazyCredential } from '@servicenow/sdk-api'

const server = http.createServer((_request, response) => {
    response.writeHead(200, { 'Content-Type': 'text/html' })
    response.end('<html><body>Login required</body></html>')
})

await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))

try {
    const address = server.address()
    const credential = new LazyCredential(
        new URL(`http://127.0.0.1:${address.port}`),
        () => ({ type: 'basic' })
    )

    const connector = new Connector(credential)
    await connector.queryTable({
        table: 'sys_app',
        encodedQuery: '',
        limit: 1,
    })
} finally {
    server.close()
}

Actual behavior

queryTable() throws the raw JSON parser error shown above.

The 4.11.0 implementation checks response.ok, but for successful HTTP status codes it calls response.json() without first validating the response content type or wrapping JSON parse failures with Table API context.

Expected behavior

The SDK should detect a non-JSON response and return an actionable, sanitized error, for example:

Table API request for 'sys_app' returned text/html instead of JSON. Authentication may have expired or the instance returned a login page.

The diagnostic should include the HTTP status, content type, and table/endpoint context, but should not echo the HTML response body because it could contain instance or authentication details.

Suggested resolution

• Validate Content-Type before parsing successful Table API responses.
• Wrap JSON parse failures with the HTTP status, content type, and table name.
• Treat an HTML response as an authentication/session or unexpected-response diagnostic rather than exposing the raw SyntaxError.

I searched the existing SDK Discussions and did not find a matching report.