oneentry 1.0.167 → 1.0.168

package/changelog.md

@@ -1,5 +1,23 @@
 # SDK Change Log
 
+## v.1.0.168
+
+### What's Fixed
+
+- **`Search.globalSearch` could not ask for a language, so a second-locale word found nothing.** The search index is per language, and the method sent no `langCode` — not even the one given to `defineOneEntry`. On a bilingual project the Spanish word "agua" came back with an empty group while the same request with `langCode=es_ES` returned a full page. The method now takes `langCode` as its last parameter, defaulting to the client's own language, so an existing call needs no edit and starts asking in the right language by itself. Measured on a bilingual stand: "agua" 0 → 30+, the English control unchanged (CMS-912).
+
+- **Methods that post a body no longer modify the object they are given.** `_normalizePostBody` wrapped `formData` and dropped an empty `phoneSMS` in place, and `signUp` and `updateUser` wrote `langCode` onto the caller's object. A body that is reused — a retry wrapper, two parallel calls, a shared default — came back already wrapped, was wrapped a second time, and the platform answered `400 "formData.en_US[0].marker" is required`: a validation error about a field the caller never sent. The normalizer now works on a copy, `notificationData` included, and the caller's object is identical after the call (CMS-909).
+
+- **A dropped connection returned `{}`, which reads exactly like an empty answer.** With `isShell` on — the default — a network failure was handed back as the thrown `TypeError`, whose `message` and `stack` are not enumerable, so it serialized to an empty object. There was no way to tell "no connection" from "no data": on one site such a value entered the page cache and was served for minutes after the link came back, and a static build baked a site of 404s while reporting success. A failure that never reached the platform now returns `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0` is a value no HTTP answer uses. An error the platform itself sent is passed through untouched (CMS-780).
+
+- **`Discounts.getBonusHistory` was declared to return an array; it returns a container.** The endpoint answers `{ items, total }` — an account with no transactions gives `{"items":[],"total":0}` — while the method and the `IDiscounts` interface both promised `IBonusTransactionEntity[]`. Code written from the type read `.length` off an object and found `undefined`. The return type is now `IBonusHistoryResponse`, exported alongside the rest. Found while covering the module with tests (CMS-531); types only, the wire format did not change.
+
+- **The declared value shapes of a form submission were the ones the platform refuses.** A body written from the types got three `400`s in a row: a `list` field typed as `[{ title, value }]` (a page attribute's shape) answers `value[0] must be a string`, a `text` field typed as an object answers `value must be an array`, and `params` inside it answers `is not allowed`; a `spam` field had no type at all and a bare token is refused with the same sentence as a wrong one. `IBodyPostFormData.formData` now uses submission-specific types — `IBodyPostTypeList` (a list of strings), `IBodyPostTypeText` (a one-element array holding exactly one of `plainValue`, `htmlValue` or `mdValue`, no `params`) and `IBodyPostTypeSpam` (`{ event: { token, siteKey } }`) — with the read types left as they were. Types and documentation only; the wire format did not change (CMS-888).
+
+### Tests
+
+- **`discounts` and `oauth` now have tests that run.** The discounts suite covered four of six methods; `getBonusBalance` and `getBonusHistory` were untested, and it was the new coverage that found the wrong return type above. The suite went from 5 cases to 8, and the bonus ones authenticate first — the balance belongs to the signed-in user and answers `401` under the app token alone. The `oauth` case was an empty shell: its body was commented out and the expectation rule disabled, so it passed while testing nothing. The happy path still cannot be covered from the test stand — it needs a provider of type `oauth` and a one-time code from that provider's consent screen, and the stand has neither — so what is pinned instead is the SDK's own half of the contract: a refusal comes back as an error value rather than an exception, and the caller's body is not modified. The limitation is written into the test rather than left as a silent pass (CMS-531, CMS-532).
+
 ## v.1.0.167
 
 ### What's New

package/dist/auth-provider/authProviderApi.js

@@ -124,8 +124,9 @@ class AuthProviderApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/auth-provider/signUp signUp} documentation.
      */
     async signUp(marker, body, langCode = this.state.lang) {
-        body['langCode'] = langCode;
-        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody(body, langCode));
+        // `langCode` goes onto our own copy — the caller's body stays as it was
+        // given, so a retry or a second parallel call sends the same thing (CMS-909).
+        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody({ ...body, langCode }, langCode));
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('SignUpResponseSchema'));
         return this._normalizeData(validated);

package/dist/base/asyncModules.d.ts

@@ -120,4 +120,22 @@ export default abstract class AsyncModules extends SyncModules {
      * @description Define an asynchronous method 'browserResponse' that takes a path and options as parameters
      */
     private browserResponse;
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _toShellError;
 }

package/dist/base/asyncModules.js

@@ -410,12 +410,45 @@ class AsyncModules extends syncModules_1.default {
             // Handle any errors that occur during the fetch process
             // Determine whether to return or throw the error based on 'isShell' state
             if (this.state.isShell) {
-                return e;
+                return this._toShellError(e);
             }
             else {
                 throw e;
             }
         }
     }
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _toShellError(e) {
+        if (e && typeof e === 'object' && 'statusCode' in e) {
+            return e;
+        }
+        const message = e instanceof Error
+            ? `${e.name}: ${e.message}`
+            : typeof e === 'string'
+                ? e
+                : 'Request failed before a response was received';
+        return {
+            statusCode: 0,
+            message,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
 }
 exports.default = AsyncModules;

package/dist/base/syncModules.d.ts

@@ -81,10 +81,17 @@ export default abstract class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     protected _normalizePostBody(body: any, langCode?: string): any;
     /**

package/dist/base/syncModules.js

@@ -220,27 +220,38 @@ class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     _normalizePostBody(body, langCode = this.state.lang) {
-        // API does not accept phoneSMS = '' — delete the field if empty.
-        if (body.notificationData && body.notificationData.phoneSMS === '') {
-            delete body.notificationData.phoneSMS;
+        const next = { ...body };
+        // API does not accept phoneSMS = '' — drop the field if empty. `notificationData`
+        // is copied too: deleting the key on the original would reach the caller.
+        if (next.notificationData && next.notificationData.phoneSMS === '') {
+            next.notificationData = { ...next.notificationData };
+            delete next.notificationData.phoneSMS;
         }
         // If formData is not provided — no further normalization needed.
-        if (!body.formData)
-            return body;
+        if (!next.formData)
+            return next;
         // Wrap form fields in an object keyed by locale:
         // [{ marker, value }]  →  { "en_US": [{ marker, value }] }
-        const formData = {};
-        formData[langCode] = Array.isArray(body.formData)
-            ? body.formData
-            : [body.formData];
-        body.formData = formData;
-        return body;
+        // The fields themselves are reused by reference — they are not modified.
+        next.formData = {
+            [langCode]: Array.isArray(next.formData)
+                ? next.formData
+                : [next.formData],
+        };
+        return next;
     }
     /**
      * Normalizes the value of a single attribute in place.

package/dist/discounts/discountsApi.d.ts

@@ -1,7 +1,7 @@
 import AsyncModules from '../base/asyncModules';
 import type StateModule from '../base/stateModule';
 import type { IError } from '../base/utils';
-import type { IBonusBalanceEntity, IBonusTransactionEntity, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces';
+import type { IBonusBalanceEntity, IBonusHistoryResponse, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces';
 /**
  * Controllers for working with events
  * @handle /api/content/events
@@ -63,11 +63,11 @@ export default class DiscountsApi extends AsyncModules implements IDiscountsApi
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Validate discounts coupon
      * @handleName validateDiscountsCoupon

package/dist/discounts/discountsApi.js

@@ -85,7 +85,7 @@ class DiscountsApi extends asyncModules_1.default {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */

package/dist/discounts/discountsInterfaces.d.ts

@@ -55,10 +55,10 @@ interface IDiscountsApi {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Semantic (vector) search for discounts.
      * @handleName getDiscountsByVectorSearch
@@ -284,6 +284,18 @@ interface IBonusTransactionEntity {
     expiresAt?: string;
     createdAt?: string;
 }
+/**
+ * @interface IBonusHistoryResponse
+ * @property {IBonusTransactionEntity[]} items - The transactions of the current page.
+ * @property {number} total - How many transactions the filter matches in total.
+ * @description Container the bonus history arrives in. The endpoint answers
+ * `{ items, total }`, not a bare array — measured on the SDK test stand,
+ * 2026-09-28: an account with no transactions answers `{"items":[],"total":0}`.
+ */
+interface IBonusHistoryResponse {
+    items: IBonusTransactionEntity[];
+    total: number;
+}
 /**
  * @interface IBonusBalanceEntity
  * @description Represents the balance of bonus points.
@@ -292,4 +304,4 @@ interface IBonusTransactionEntity {
 interface IBonusBalanceEntity {
     balance: number;
 }
-export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };
+export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusHistoryResponse, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };

package/dist/forms-data/formsDataInterfaces.d.ts

@@ -420,6 +420,133 @@ interface IUpdateFormsData {
  * Contains an array of data form objects with the following values
  */
 type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeText | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | IBodyTypeRadioButtonList | Record<string, unknown>;
+/**
+ * Value shapes accepted by a SUBMISSION (`POST /form-data`).
+ *
+ * For three field kinds they are not the shapes a page attribute uses, and a
+ * body written from the read types is refused. Measured on
+ * rwah2o.oneentry.cloud, 2026-09-12 and again 2026-09-28 (CMS-888).
+ *
+ * `list` takes a list of strings; the `[{ title, value }]` form of a page
+ * attribute answers `400 formData's marker '<marker>' value[0] must be a string`.
+ *
+ * `text` takes a one-element array holding exactly ONE of `plainValue`,
+ * `htmlValue` or `mdValue`, and no `params`. The object form answers
+ * `400 … value must be an array`, `params` answers `… is not allowed`, and two
+ * representations answer `Only one of htmlValue, plainValue or mdValue can be provided`.
+ *
+ * `spam` takes the captcha event, not the bare token.
+ */
+type FormDataPostType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyPostTypeText | IBodyPostTypeList | IBodyPostTypeSpam | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | Record<string, unknown>;
+/**
+ * Represents a `list` field of a form SUBMISSION.
+ * @interface IBodyPostTypeList
+ * @property {string} marker - marker name. Example: "recipient".
+ * @property {string} type - Type value. Example: "list".
+ * @property {string[]} value - Chosen options as plain strings. Example: ["Tom Hoffart"].
+ * @example
+    {
+      "marker": "recipient",
+      "type": "list",
+      "value": ["Tom Hoffart"]
+    }
+ * @description A submission sends the chosen options as strings. The `[{ title, value }]`
+ * shape a page attribute stores is refused here with `value[0] must be a string`.
+ */
+interface IBodyPostTypeList {
+    marker: string;
+    type: 'list';
+    value: string[];
+}
+/**
+ * Represents a `text` field of a form SUBMISSION.
+ * @interface IBodyPostTypeText
+ * @property {string} marker - marker name. Example: "your_message".
+ * @property {string} type - Type value. Example: "text".
+ * @property {ITextSubmissionValue[]} value - One-element array holding exactly one representation.
+ * @example
+    {
+      "marker": "your_message",
+      "type": "text",
+      "value": [{ "plainValue": "Hello" }]
+    }
+ * @description The array holds one object carrying exactly one of `plainValue`,
+ * `htmlValue` or `mdValue`. Editor `params` are refused, and so is sending two
+ * representations at once.
+ */
+interface IBodyPostTypeText {
+    marker: string;
+    type: 'text';
+    value: ITextSubmissionValue[];
+}
+/**
+ * @interface ITextSubmissionValuePlain
+ * @property {string} plainValue - Plain-text representation. Example: "Hello".
+ * @description Plain-text branch of a submitted text value.
+ */
+interface ITextSubmissionValuePlain {
+    plainValue: string;
+}
+/**
+ * @interface ITextSubmissionValueHtml
+ * @property {string} htmlValue - HTML representation. Example: "<p>Hello</p>".
+ * @description HTML branch of a submitted text value.
+ */
+interface ITextSubmissionValueHtml {
+    htmlValue: string;
+}
+/**
+ * @interface ITextSubmissionValueMd
+ * @property {string} mdValue - Markdown representation. Must not be empty. Example: "**Hello**".
+ * @description Markdown branch of a submitted text value.
+ */
+interface ITextSubmissionValueMd {
+    mdValue: string;
+}
+/**
+ * Exactly one representation of a submitted text value.
+ */
+type ITextSubmissionValue = ITextSubmissionValuePlain | ITextSubmissionValueHtml | ITextSubmissionValueMd;
+/**
+ * Represents a `spam` (captcha) field of a form SUBMISSION.
+ * @interface IBodyPostTypeSpam
+ * @property {string} marker - marker name. Example: "spam".
+ * @property {string} type - Type value. Example: "spam".
+ * @property {ICaptchaValue} value - The captcha event, not the bare token.
+ * @example
+    {
+      "marker": "spam",
+      "type": "spam",
+      "value": { "event": { "token": "<reCAPTCHA v3 token>", "siteKey": "6Ldjk7Yt…" } }
+    }
+ * @description The field carries a reCAPTCHA v3 token obtained in the browser.
+ * A bare string is refused with the same sentence as a wrong token —
+ * `Captcha Validation Failed, captcha type is: google` — so a malformed value
+ * is indistinguishable from a bot.
+ */
+interface IBodyPostTypeSpam {
+    marker: string;
+    type: 'spam';
+    value: ICaptchaValue;
+}
+/**
+ * @interface ICaptchaEvent
+ * @property {string} token - The token issued by the captcha provider in the browser.
+ * @property {string} siteKey - The site key the token was issued for. Example: "6Ldjk7Yt…".
+ * @description The captcha payload of a `spam` field.
+ */
+interface ICaptchaEvent {
+    token: string;
+    siteKey: string;
+}
+/**
+ * @interface ICaptchaValue
+ * @property {ICaptchaEvent} event - The captcha payload.
+ * @description Wrapper the platform expects around the captcha payload.
+ */
+interface ICaptchaValue {
+    event: ICaptchaEvent;
+}
 /**
  * Represents the structure of the body for posting form data.
  * @interface IBodyPostFormData
@@ -428,7 +555,7 @@ type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeTe
  * @property {string} moduleEntityIdentifier - Text identifier (marker) of the module entity. Example: "blog".
  * @property {string | null} replayTo - Email to reply to. Example: "some@email.com".
  * @property {string} status - Status of the form. Example: "sent".
- * @property {FormDataType[]} formData - Array of form data objects.
+ * @property {FormDataPostType[]} formData - Array of form data objects. A submission's value shapes differ from the read shapes — see FormDataPostType.
  * @example
     [
       {
@@ -455,7 +582,7 @@ interface IBodyPostFormData {
     moduleEntityIdentifier: string;
     replayTo: string | null;
     status: string;
-    formData: FormDataType[];
+    formData: FormDataPostType[];
     fileQuery?: IUploadingQuery;
 }
 /**
@@ -711,4 +838,4 @@ interface IListOptionValue {
     value: string;
     extended: IListOptionExtended;
 }
-export type { FormDataStatus, FormDataType, IBodyPostFormData, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };
+export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };

package/dist/search/searchApi.d.ts

@@ -26,10 +26,11 @@ export default class SearchApi extends AsyncModules implements ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }

package/dist/search/searchApi.js

@@ -64,19 +64,23 @@ class SearchApi extends asyncModules_1.default {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    async globalSearch(query, types, visibility, offset, limit) {
+    async globalSearch(query, types, visibility, offset, limit, langCode = this.state.lang) {
         // `types` is sent comma-separated — the array stringifies to exactly that.
+        // `langCode` is not optional decoration: the index is per language, and
+        // without it a word of a second locale answers an empty group (CMS-912).
         const params = {
             q: query,
             types,
             visibility,
             offset,
             limit,
+            langCode,
         };
         const data = await this._fetchGet(`?` + this._queryParamsToString(params));
         const validated = await this._validateResponse(data, schema('GlobalSearchResponseSchema'));

package/dist/search/searchInterfaces.d.ts

@@ -13,11 +13,12 @@ interface ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }
 /**
  * Entity type a global search group or item belongs to.

package/dist/users/usersApi.js

@@ -147,9 +147,9 @@ class UsersApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/users/updateUser updateUser} documentation.
      */
     async updateUser(body, langCode = this.state.lang) {
-        if (!('langCode' in body))
-            body['langCode'] = langCode;
-        const result = await this._fetchPut('/me', this._normalizePostBody(body, langCode));
+        // The language goes onto our own copy; the caller's body is left alone (CMS-909).
+        const payload = 'langCode' in body ? body : { ...body, langCode };
+        const result = await this._fetchPut('/me', this._normalizePostBody(payload, langCode));
         const validated = await this._validateResponse(result, schema('UpdateUserResponseSchema'));
         return validated;
     }

package/esm/auth-provider/authProviderApi.js

@@ -86,8 +86,9 @@ export default class AuthProviderApi extends AsyncModules {
      * @see {@link https://js-sdk.oneentry.cloud/docs/auth-provider/signUp signUp} documentation.
      */
     async signUp(marker, body, langCode = this.state.lang) {
-        body['langCode'] = langCode;
-        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody(body, langCode));
+        // `langCode` goes onto our own copy — the caller's body stays as it was
+        // given, so a retry or a second parallel call sends the same thing (CMS-909).
+        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody({ ...body, langCode }, langCode));
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('SignUpResponseSchema'));
         return this._normalizeData(validated);

package/esm/base/asyncModules.d.ts

@@ -120,4 +120,22 @@ export default abstract class AsyncModules extends SyncModules {
      * @description Define an asynchronous method 'browserResponse' that takes a path and options as parameters
      */
     private browserResponse;
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _toShellError;
 }

package/esm/base/asyncModules.js

@@ -372,11 +372,44 @@ export default class AsyncModules extends SyncModules {
             // Handle any errors that occur during the fetch process
             // Determine whether to return or throw the error based on 'isShell' state
             if (this.state.isShell) {
-                return e;
+                return this._toShellError(e);
             }
             else {
                 throw e;
             }
         }
     }
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _toShellError(e) {
+        if (e && typeof e === 'object' && 'statusCode' in e) {
+            return e;
+        }
+        const message = e instanceof Error
+            ? `${e.name}: ${e.message}`
+            : typeof e === 'string'
+                ? e
+                : 'Request failed before a response was received';
+        return {
+            statusCode: 0,
+            message,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
 }

package/esm/base/syncModules.d.ts

@@ -81,10 +81,17 @@ export default abstract class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     protected _normalizePostBody(body: any, langCode?: string): any;
     /**

package/esm/base/syncModules.js

@@ -218,27 +218,38 @@ export default class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     _normalizePostBody(body, langCode = this.state.lang) {
-        // API does not accept phoneSMS = '' — delete the field if empty.
-        if (body.notificationData && body.notificationData.phoneSMS === '') {
-            delete body.notificationData.phoneSMS;
+        const next = { ...body };
+        // API does not accept phoneSMS = '' — drop the field if empty. `notificationData`
+        // is copied too: deleting the key on the original would reach the caller.
+        if (next.notificationData && next.notificationData.phoneSMS === '') {
+            next.notificationData = { ...next.notificationData };
+            delete next.notificationData.phoneSMS;
         }
         // If formData is not provided — no further normalization needed.
-        if (!body.formData)
-            return body;
+        if (!next.formData)
+            return next;
         // Wrap form fields in an object keyed by locale:
         // [{ marker, value }]  →  { "en_US": [{ marker, value }] }
-        const formData = {};
-        formData[langCode] = Array.isArray(body.formData)
-            ? body.formData
-            : [body.formData];
-        body.formData = formData;
-        return body;
+        // The fields themselves are reused by reference — they are not modified.
+        next.formData = {
+            [langCode]: Array.isArray(next.formData)
+                ? next.formData
+                : [next.formData],
+        };
+        return next;
     }
     /**
      * Normalizes the value of a single attribute in place.

package/esm/discounts/discountsApi.d.ts

@@ -1,7 +1,7 @@
 import AsyncModules from '../base/asyncModules.js';
 import type StateModule from '../base/stateModule.js';
 import type { IError } from '../base/utils.js';
-import type { IBonusBalanceEntity, IBonusTransactionEntity, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces.js';
+import type { IBonusBalanceEntity, IBonusHistoryResponse, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces.js';
 /**
  * Controllers for working with events
  * @handle /api/content/events
@@ -63,11 +63,11 @@ export default class DiscountsApi extends AsyncModules implements IDiscountsApi
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Validate discounts coupon
      * @handleName validateDiscountsCoupon

package/esm/discounts/discountsApi.js

@@ -80,7 +80,7 @@ export default class DiscountsApi extends AsyncModules {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */

package/esm/discounts/discountsInterfaces.d.ts

@@ -55,10 +55,10 @@ interface IDiscountsApi {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Semantic (vector) search for discounts.
      * @handleName getDiscountsByVectorSearch
@@ -284,6 +284,18 @@ interface IBonusTransactionEntity {
     expiresAt?: string;
     createdAt?: string;
 }
+/**
+ * @interface IBonusHistoryResponse
+ * @property {IBonusTransactionEntity[]} items - The transactions of the current page.
+ * @property {number} total - How many transactions the filter matches in total.
+ * @description Container the bonus history arrives in. The endpoint answers
+ * `{ items, total }`, not a bare array — measured on the SDK test stand,
+ * 2026-09-28: an account with no transactions answers `{"items":[],"total":0}`.
+ */
+interface IBonusHistoryResponse {
+    items: IBonusTransactionEntity[];
+    total: number;
+}
 /**
  * @interface IBonusBalanceEntity
  * @description Represents the balance of bonus points.
@@ -292,4 +304,4 @@ interface IBonusTransactionEntity {
 interface IBonusBalanceEntity {
     balance: number;
 }
-export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };
+export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusHistoryResponse, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };

package/esm/forms-data/formsDataInterfaces.d.ts

@@ -420,6 +420,133 @@ interface IUpdateFormsData {
  * Contains an array of data form objects with the following values
  */
 type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeText | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | IBodyTypeRadioButtonList | Record<string, unknown>;
+/**
+ * Value shapes accepted by a SUBMISSION (`POST /form-data`).
+ *
+ * For three field kinds they are not the shapes a page attribute uses, and a
+ * body written from the read types is refused. Measured on
+ * rwah2o.oneentry.cloud, 2026-09-12 and again 2026-09-28 (CMS-888).
+ *
+ * `list` takes a list of strings; the `[{ title, value }]` form of a page
+ * attribute answers `400 formData's marker '<marker>' value[0] must be a string`.
+ *
+ * `text` takes a one-element array holding exactly ONE of `plainValue`,
+ * `htmlValue` or `mdValue`, and no `params`. The object form answers
+ * `400 … value must be an array`, `params` answers `… is not allowed`, and two
+ * representations answer `Only one of htmlValue, plainValue or mdValue can be provided`.
+ *
+ * `spam` takes the captcha event, not the bare token.
+ */
+type FormDataPostType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyPostTypeText | IBodyPostTypeList | IBodyPostTypeSpam | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | Record<string, unknown>;
+/**
+ * Represents a `list` field of a form SUBMISSION.
+ * @interface IBodyPostTypeList
+ * @property {string} marker - marker name. Example: "recipient".
+ * @property {string} type - Type value. Example: "list".
+ * @property {string[]} value - Chosen options as plain strings. Example: ["Tom Hoffart"].
+ * @example
+    {
+      "marker": "recipient",
+      "type": "list",
+      "value": ["Tom Hoffart"]
+    }
+ * @description A submission sends the chosen options as strings. The `[{ title, value }]`
+ * shape a page attribute stores is refused here with `value[0] must be a string`.
+ */
+interface IBodyPostTypeList {
+    marker: string;
+    type: 'list';
+    value: string[];
+}
+/**
+ * Represents a `text` field of a form SUBMISSION.
+ * @interface IBodyPostTypeText
+ * @property {string} marker - marker name. Example: "your_message".
+ * @property {string} type - Type value. Example: "text".
+ * @property {ITextSubmissionValue[]} value - One-element array holding exactly one representation.
+ * @example
+    {
+      "marker": "your_message",
+      "type": "text",
+      "value": [{ "plainValue": "Hello" }]
+    }
+ * @description The array holds one object carrying exactly one of `plainValue`,
+ * `htmlValue` or `mdValue`. Editor `params` are refused, and so is sending two
+ * representations at once.
+ */
+interface IBodyPostTypeText {
+    marker: string;
+    type: 'text';
+    value: ITextSubmissionValue[];
+}
+/**
+ * @interface ITextSubmissionValuePlain
+ * @property {string} plainValue - Plain-text representation. Example: "Hello".
+ * @description Plain-text branch of a submitted text value.
+ */
+interface ITextSubmissionValuePlain {
+    plainValue: string;
+}
+/**
+ * @interface ITextSubmissionValueHtml
+ * @property {string} htmlValue - HTML representation. Example: "<p>Hello</p>".
+ * @description HTML branch of a submitted text value.
+ */
+interface ITextSubmissionValueHtml {
+    htmlValue: string;
+}
+/**
+ * @interface ITextSubmissionValueMd
+ * @property {string} mdValue - Markdown representation. Must not be empty. Example: "**Hello**".
+ * @description Markdown branch of a submitted text value.
+ */
+interface ITextSubmissionValueMd {
+    mdValue: string;
+}
+/**
+ * Exactly one representation of a submitted text value.
+ */
+type ITextSubmissionValue = ITextSubmissionValuePlain | ITextSubmissionValueHtml | ITextSubmissionValueMd;
+/**
+ * Represents a `spam` (captcha) field of a form SUBMISSION.
+ * @interface IBodyPostTypeSpam
+ * @property {string} marker - marker name. Example: "spam".
+ * @property {string} type - Type value. Example: "spam".
+ * @property {ICaptchaValue} value - The captcha event, not the bare token.
+ * @example
+    {
+      "marker": "spam",
+      "type": "spam",
+      "value": { "event": { "token": "<reCAPTCHA v3 token>", "siteKey": "6Ldjk7Yt…" } }
+    }
+ * @description The field carries a reCAPTCHA v3 token obtained in the browser.
+ * A bare string is refused with the same sentence as a wrong token —
+ * `Captcha Validation Failed, captcha type is: google` — so a malformed value
+ * is indistinguishable from a bot.
+ */
+interface IBodyPostTypeSpam {
+    marker: string;
+    type: 'spam';
+    value: ICaptchaValue;
+}
+/**
+ * @interface ICaptchaEvent
+ * @property {string} token - The token issued by the captcha provider in the browser.
+ * @property {string} siteKey - The site key the token was issued for. Example: "6Ldjk7Yt…".
+ * @description The captcha payload of a `spam` field.
+ */
+interface ICaptchaEvent {
+    token: string;
+    siteKey: string;
+}
+/**
+ * @interface ICaptchaValue
+ * @property {ICaptchaEvent} event - The captcha payload.
+ * @description Wrapper the platform expects around the captcha payload.
+ */
+interface ICaptchaValue {
+    event: ICaptchaEvent;
+}
 /**
  * Represents the structure of the body for posting form data.
  * @interface IBodyPostFormData
@@ -428,7 +555,7 @@ type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeTe
  * @property {string} moduleEntityIdentifier - Text identifier (marker) of the module entity. Example: "blog".
  * @property {string | null} replayTo - Email to reply to. Example: "some@email.com".
  * @property {string} status - Status of the form. Example: "sent".
- * @property {FormDataType[]} formData - Array of form data objects.
+ * @property {FormDataPostType[]} formData - Array of form data objects. A submission's value shapes differ from the read shapes — see FormDataPostType.
  * @example
     [
       {
@@ -455,7 +582,7 @@ interface IBodyPostFormData {
     moduleEntityIdentifier: string;
     replayTo: string | null;
     status: string;
-    formData: FormDataType[];
+    formData: FormDataPostType[];
     fileQuery?: IUploadingQuery;
 }
 /**
@@ -711,4 +838,4 @@ interface IListOptionValue {
     value: string;
     extended: IListOptionExtended;
 }
-export type { FormDataStatus, FormDataType, IBodyPostFormData, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };
+export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };

package/esm/search/searchApi.d.ts

@@ -26,10 +26,11 @@ export default class SearchApi extends AsyncModules implements ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }

package/esm/search/searchApi.js

@@ -26,19 +26,23 @@ export default class SearchApi extends AsyncModules {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    async globalSearch(query, types, visibility, offset, limit) {
+    async globalSearch(query, types, visibility, offset, limit, langCode = this.state.lang) {
         // `types` is sent comma-separated — the array stringifies to exactly that.
+        // `langCode` is not optional decoration: the index is per language, and
+        // without it a word of a second locale answers an empty group (CMS-912).
         const params = {
             q: query,
             types,
             visibility,
             offset,
             limit,
+            langCode,
         };
         const data = await this._fetchGet(`?` + this._queryParamsToString(params));
         const validated = await this._validateResponse(data, schema('GlobalSearchResponseSchema'));

package/esm/search/searchInterfaces.d.ts

@@ -13,11 +13,12 @@ interface ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }
 /**
  * Entity type a global search group or item belongs to.

package/esm/users/usersApi.js

@@ -109,9 +109,9 @@ export default class UsersApi extends AsyncModules {
      * @see {@link https://js-sdk.oneentry.cloud/docs/users/updateUser updateUser} documentation.
      */
     async updateUser(body, langCode = this.state.lang) {
-        if (!('langCode' in body))
-            body['langCode'] = langCode;
-        const result = await this._fetchPut('/me', this._normalizePostBody(body, langCode));
+        // The language goes onto our own copy; the caller's body is left alone (CMS-909).
+        const payload = 'langCode' in body ? body : { ...body, langCode };
+        const result = await this._fetchPut('/me', this._normalizePostBody(payload, langCode));
         const validated = await this._validateResponse(result, schema('UpdateUserResponseSchema'));
         return validated;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oneentry",
-  "version": "1.0.167",
+  "version": "1.0.168",
   "description": "OneEntry NPM package",
   "main": "dist/index.js",
   "module": "esm/index.js",
@@ -48,7 +48,7 @@
   },
   "scripts": {
     "prepublishOnly": "node ../scripts/smoke-pack.js --files-only",
-    "postpublish": "node ../scripts/verify-published.js --named defineOneEntry --expect 1.0.167"
+    "postpublish": "node ../scripts/verify-published.js --named defineOneEntry --expect 1.0.168"
   },
   "sideEffects": false,
   "files": [