oneentry 1.0.167 → 1.0.169

package/changelog.md

@@ -1,5 +1,33 @@
 # SDK Change Log
 
+## v.1.0.169
+
+### What's Fixed
+
+- **A response that is not JSON came back as a parser message, and on the error branch as nothing at all.** The platform has been seen answering `200 OK` with `content-type: text/html` and its own admin page as the body — every content endpoint of a project at once, for minutes, a single request enough to reproduce it (CMS-957). A successful status carrying someone else's body cannot be told apart from a real answer by status alone, and all the caller got was `SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON`: a sentence about the SDK's own parsing rather than about what arrived. Read as "this record does not exist", it made a static build of a demo shop bake `404` into 8 of 54 product pages while every one of those products was live. The same body behind a failing status was worse: `_parseJson` swallowed it and returned `{}`, which carries no `statusCode` and therefore does not read as an error at all, so a `502` came back looking like an empty success. A body that is not JSON is now described — `Expected JSON from the platform, received text/html (HTTP 200): <!DOCTYPE html>…` — with `statusCode: 0` on a successful status, the same "no usable answer" contract as a dropped connection, and the status the server really sent when it failed. Token refresh reads its body through the same helper instead of `response.json()`, so an HTML answer there fails the refresh rather than throwing a raw parse error out of the request that triggered it.
+
+### Tests
+
+- **`src/base/tests/nonjson.spec.ts` pins the five outcomes** with a stubbed `fetch`, no stand required: HTML behind a `200`, HTML behind a `502`, a normal JSON answer, an empty body, and an error the platform itself sent.
+
+## v.1.0.168
+
+### What's Fixed
+
+- **`Search.globalSearch` could not ask for a language, so a second-locale word found nothing.** The search index is per language, and the method sent no `langCode` — not even the one given to `defineOneEntry`. On a bilingual project the Spanish word "agua" came back with an empty group while the same request with `langCode=es_ES` returned a full page. The method now takes `langCode` as its last parameter, defaulting to the client's own language, so an existing call needs no edit and starts asking in the right language by itself. Measured on a bilingual stand: "agua" 0 → 30+, the English control unchanged (CMS-912).
+
+- **Methods that post a body no longer modify the object they are given.** `_normalizePostBody` wrapped `formData` and dropped an empty `phoneSMS` in place, and `signUp` and `updateUser` wrote `langCode` onto the caller's object. A body that is reused — a retry wrapper, two parallel calls, a shared default — came back already wrapped, was wrapped a second time, and the platform answered `400 "formData.en_US[0].marker" is required`: a validation error about a field the caller never sent. The normalizer now works on a copy, `notificationData` included, and the caller's object is identical after the call (CMS-909).
+
+- **A dropped connection returned `{}`, which reads exactly like an empty answer.** With `isShell` on — the default — a network failure was handed back as the thrown `TypeError`, whose `message` and `stack` are not enumerable, so it serialized to an empty object. There was no way to tell "no connection" from "no data": on one site such a value entered the page cache and was served for minutes after the link came back, and a static build baked a site of 404s while reporting success. A failure that never reached the platform now returns `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0` is a value no HTTP answer uses. An error the platform itself sent is passed through untouched (CMS-780).
+
+- **`Discounts.getBonusHistory` was declared to return an array; it returns a container.** The endpoint answers `{ items, total }` — an account with no transactions gives `{"items":[],"total":0}` — while the method and the `IDiscounts` interface both promised `IBonusTransactionEntity[]`. Code written from the type read `.length` off an object and found `undefined`. The return type is now `IBonusHistoryResponse`, exported alongside the rest. Found while covering the module with tests (CMS-531); types only, the wire format did not change.
+
+- **The declared value shapes of a form submission were the ones the platform refuses.** A body written from the types got three `400`s in a row: a `list` field typed as `[{ title, value }]` (a page attribute's shape) answers `value[0] must be a string`, a `text` field typed as an object answers `value must be an array`, and `params` inside it answers `is not allowed`; a `spam` field had no type at all and a bare token is refused with the same sentence as a wrong one. `IBodyPostFormData.formData` now uses submission-specific types — `IBodyPostTypeList` (a list of strings), `IBodyPostTypeText` (a one-element array holding exactly one of `plainValue`, `htmlValue` or `mdValue`, no `params`) and `IBodyPostTypeSpam` (`{ event: { token, siteKey } }`) — with the read types left as they were. Types and documentation only; the wire format did not change (CMS-888).
+
+### Tests
+
+- **`discounts` and `oauth` now have tests that run.** The discounts suite covered four of six methods; `getBonusBalance` and `getBonusHistory` were untested, and it was the new coverage that found the wrong return type above. The suite went from 5 cases to 8, and the bonus ones authenticate first — the balance belongs to the signed-in user and answers `401` under the app token alone. The `oauth` case was an empty shell: its body was commented out and the expectation rule disabled, so it passed while testing nothing. The happy path still cannot be covered from the test stand — it needs a provider of type `oauth` and a one-time code from that provider's consent screen, and the stand has neither — so what is pinned instead is the SDK's own half of the contract: a refusal comes back as an error value rather than an exception, and the caller's body is not modified. The limitation is written into the test rather than left as a silent pass (CMS-531, CMS-532).
+
 ## v.1.0.167
 
 ### What's New

package/dist/auth-provider/authProviderApi.js

@@ -124,8 +124,9 @@ class AuthProviderApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/auth-provider/signUp signUp} documentation.
      */
     async signUp(marker, body, langCode = this.state.lang) {
-        body['langCode'] = langCode;
-        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody(body, langCode));
+        // `langCode` goes onto our own copy — the caller's body stays as it was
+        // given, so a retry or a second parallel call sends the same thing (CMS-909).
+        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody({ ...body, langCode }, langCode));
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('SignUpResponseSchema'));
         return this._normalizeData(validated);

package/dist/base/asyncModules.d.ts

@@ -103,13 +103,19 @@ export default abstract class AsyncModules extends SyncModules {
      */
     private makeOptions;
     /**
-     * Reads a response body as JSON, tolerating an empty body.
+     * Reads an error response body as JSON, tolerating an empty body.
      *
      * `Response.json()` throws on an empty body (e.g. 204 or an empty error
      * payload); this helper mirrors the OK-path guard (`text ? JSON.parse : {}`)
      * so both the success and the error branches handle empty bodies the same way.
+     *
+     * A body that is present but is not JSON — a gateway's HTML page in front of a
+     * 502, the platform's own admin page (CMS-957) — used to collapse into `{}`,
+     * which carries no `statusCode` and therefore does not read as an error at all:
+     * a failed request came back looking like an empty success. It is described
+     * instead, keeping the status the server actually sent.
      * @param {Response} response - The fetch Response to read.
-     * @returns {Promise<unknown>} Parsed JSON, or an empty object when the body is empty/unparsable.
+     * @returns {Promise<unknown>} Parsed JSON, `{}` for an empty body, or a described error for a body that is not JSON.
      */
     private _parseJson;
     /**
@@ -120,4 +126,42 @@ export default abstract class AsyncModules extends SyncModules {
      * @description Define an asynchronous method 'browserResponse' that takes a path and options as parameters
      */
     private browserResponse;
+    /**
+     * Describes a response whose body is not the JSON the API is supposed to send.
+     *
+     * The platform has been seen answering `200 OK` with `content-type: text/html`
+     * and the admin page as the body — every content endpoint at once, for minutes
+     * (CMS-957). A successful status carrying someone else's body is indistinguishable
+     * from a real answer by status alone, and the only symptom used to be
+     * `SyntaxError: Unexpected token '<'` from the JSON parser: a message about the
+     * SDK's own parsing rather than about what the platform did. Callers read that as
+     * "this record does not exist" and a static build baked 404s over live products.
+     *
+     * The returned error names the received content type, the HTTP status and the
+     * first characters of the body, so a log line says what arrived instead of JSON.
+     * `statusCode` stays `0` — the request produced no usable answer, the same
+     * contract as a dropped connection, and a value no HTTP answer uses.
+     * @param {Response} response - The response whose body could not be parsed.
+     * @param {string} text - The raw body as read.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _nonJsonError;
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _toShellError;
 }

package/dist/base/asyncModules.js

@@ -239,8 +239,14 @@ class AsyncModules extends syncModules_1.default {
         });
         // Check if the response status is OK (status code 200-299)
         if (response.ok) {
-            // Parse the response body as JSON and store the result
-            const result = await response.json();
+            // Parsed through the shared helper rather than `response.json()`: a `200` whose body is
+            // not JSON (CMS-957) threw a raw SyntaxError out of the refresh and took the request that
+            // triggered it with it. A body without tokens is a failed refresh, reported as such.
+            const result = await this._parseJson(response);
+            if (typeof (result === null || result === void 0 ? void 0 : result.refreshToken) !== 'string' ||
+                typeof (result === null || result === void 0 ? void 0 : result.accessToken) !== 'string') {
+                return false;
+            }
             // Update the state's refreshToken and accessToken with the new tokens from the response
             this.state.refreshToken = result.refreshToken;
             this.state.accessToken = result.accessToken;
@@ -313,22 +319,37 @@ class AsyncModules extends syncModules_1.default {
         return options;
     }
     /**
-     * Reads a response body as JSON, tolerating an empty body.
+     * Reads an error response body as JSON, tolerating an empty body.
      *
      * `Response.json()` throws on an empty body (e.g. 204 or an empty error
      * payload); this helper mirrors the OK-path guard (`text ? JSON.parse : {}`)
      * so both the success and the error branches handle empty bodies the same way.
+     *
+     * A body that is present but is not JSON — a gateway's HTML page in front of a
+     * 502, the platform's own admin page (CMS-957) — used to collapse into `{}`,
+     * which carries no `statusCode` and therefore does not read as an error at all:
+     * a failed request came back looking like an empty success. It is described
+     * instead, keeping the status the server actually sent.
      * @param {Response} response - The fetch Response to read.
-     * @returns {Promise<unknown>} Parsed JSON, or an empty object when the body is empty/unparsable.
+     * @returns {Promise<unknown>} Parsed JSON, `{}` for an empty body, or a described error for a body that is not JSON.
      */
     async _parseJson(response) {
+        let text;
         try {
-            const text = await response.text();
-            return text ? JSON.parse(text) : {};
+            text = await response.text();
         }
         catch {
             return {};
         }
+        if (!text) {
+            return {};
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return this._nonJsonError(response, text);
+        }
     }
     /**
      * Handles responses from the browser's fetch API.
@@ -386,10 +407,18 @@ class AsyncModules extends syncModules_1.default {
             // Check if the response status is OK (status code 200-299)
             if (response.ok) {
                 // Read the body as text; if it is empty return an empty object,
-                // otherwise parse it as JSON. A parse failure propagates to the
-                // catch below and is handled according to isShell.
+                // otherwise parse it as JSON. A body that is not JSON is turned into a
+                // described error by `_nonJsonError` and handled according to isShell.
                 const text = await response.text();
-                return (text ? JSON.parse(text) : {});
+                if (!text) {
+                    return {};
+                }
+                try {
+                    return JSON.parse(text);
+                }
+                catch {
+                    throw this._nonJsonError(response, text);
+                }
             }
             // Handle non-OK responses (applies to the first response and to a failed retry).
             const status = response.status;
@@ -410,12 +439,79 @@ class AsyncModules extends syncModules_1.default {
             // Handle any errors that occur during the fetch process
             // Determine whether to return or throw the error based on 'isShell' state
             if (this.state.isShell) {
-                return e;
+                return this._toShellError(e);
             }
             else {
                 throw e;
             }
         }
     }
+    /**
+     * Describes a response whose body is not the JSON the API is supposed to send.
+     *
+     * The platform has been seen answering `200 OK` with `content-type: text/html`
+     * and the admin page as the body — every content endpoint at once, for minutes
+     * (CMS-957). A successful status carrying someone else's body is indistinguishable
+     * from a real answer by status alone, and the only symptom used to be
+     * `SyntaxError: Unexpected token '<'` from the JSON parser: a message about the
+     * SDK's own parsing rather than about what the platform did. Callers read that as
+     * "this record does not exist" and a static build baked 404s over live products.
+     *
+     * The returned error names the received content type, the HTTP status and the
+     * first characters of the body, so a log line says what arrived instead of JSON.
+     * `statusCode` stays `0` — the request produced no usable answer, the same
+     * contract as a dropped connection, and a value no HTTP answer uses.
+     * @param {Response} response - The response whose body could not be parsed.
+     * @param {string} text - The raw body as read.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _nonJsonError(response, text) {
+        var _a, _b, _c;
+        const contentType = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : 'unknown';
+        const excerpt = text.trim().slice(0, 120).replace(/\s+/g, ' ');
+        return {
+            // A successful status carrying a non-JSON body produced no usable answer, the same
+            // contract as a dropped connection. A failing one already says something true about
+            // the request, so that status is kept.
+            statusCode: response.ok ? 0 : response.status,
+            message: `Expected JSON from the platform, received ${contentType} ` +
+                `(HTTP ${response.status}): ${excerpt}`,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _toShellError(e) {
+        if (e && typeof e === 'object' && 'statusCode' in e) {
+            return e;
+        }
+        const message = e instanceof Error
+            ? `${e.name}: ${e.message}`
+            : typeof e === 'string'
+                ? e
+                : 'Request failed before a response was received';
+        return {
+            statusCode: 0,
+            message,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
 }
 exports.default = AsyncModules;

package/dist/base/syncModules.d.ts

@@ -81,10 +81,17 @@ export default abstract class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     protected _normalizePostBody(body: any, langCode?: string): any;
     /**

package/dist/base/syncModules.js

@@ -220,27 +220,38 @@ class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     _normalizePostBody(body, langCode = this.state.lang) {
-        // API does not accept phoneSMS = '' — delete the field if empty.
-        if (body.notificationData && body.notificationData.phoneSMS === '') {
-            delete body.notificationData.phoneSMS;
+        const next = { ...body };
+        // API does not accept phoneSMS = '' — drop the field if empty. `notificationData`
+        // is copied too: deleting the key on the original would reach the caller.
+        if (next.notificationData && next.notificationData.phoneSMS === '') {
+            next.notificationData = { ...next.notificationData };
+            delete next.notificationData.phoneSMS;
         }
         // If formData is not provided — no further normalization needed.
-        if (!body.formData)
-            return body;
+        if (!next.formData)
+            return next;
         // Wrap form fields in an object keyed by locale:
         // [{ marker, value }]  →  { "en_US": [{ marker, value }] }
-        const formData = {};
-        formData[langCode] = Array.isArray(body.formData)
-            ? body.formData
-            : [body.formData];
-        body.formData = formData;
-        return body;
+        // The fields themselves are reused by reference — they are not modified.
+        next.formData = {
+            [langCode]: Array.isArray(next.formData)
+                ? next.formData
+                : [next.formData],
+        };
+        return next;
     }
     /**
      * Normalizes the value of a single attribute in place.

package/dist/discounts/discountsApi.d.ts

@@ -1,7 +1,7 @@
 import AsyncModules from '../base/asyncModules';
 import type StateModule from '../base/stateModule';
 import type { IError } from '../base/utils';
-import type { IBonusBalanceEntity, IBonusTransactionEntity, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces';
+import type { IBonusBalanceEntity, IBonusHistoryResponse, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces';
 /**
  * Controllers for working with events
  * @handle /api/content/events
@@ -63,11 +63,11 @@ export default class DiscountsApi extends AsyncModules implements IDiscountsApi
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Validate discounts coupon
      * @handleName validateDiscountsCoupon

package/dist/discounts/discountsApi.js

@@ -85,7 +85,7 @@ class DiscountsApi extends asyncModules_1.default {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */

package/dist/discounts/discountsInterfaces.d.ts

@@ -55,10 +55,10 @@ interface IDiscountsApi {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Semantic (vector) search for discounts.
      * @handleName getDiscountsByVectorSearch
@@ -284,6 +284,18 @@ interface IBonusTransactionEntity {
     expiresAt?: string;
     createdAt?: string;
 }
+/**
+ * @interface IBonusHistoryResponse
+ * @property {IBonusTransactionEntity[]} items - The transactions of the current page.
+ * @property {number} total - How many transactions the filter matches in total.
+ * @description Container the bonus history arrives in. The endpoint answers
+ * `{ items, total }`, not a bare array — measured on the SDK test stand,
+ * 2026-09-28: an account with no transactions answers `{"items":[],"total":0}`.
+ */
+interface IBonusHistoryResponse {
+    items: IBonusTransactionEntity[];
+    total: number;
+}
 /**
  * @interface IBonusBalanceEntity
  * @description Represents the balance of bonus points.
@@ -292,4 +304,4 @@ interface IBonusTransactionEntity {
 interface IBonusBalanceEntity {
     balance: number;
 }
-export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };
+export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusHistoryResponse, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };

package/dist/forms-data/formsDataInterfaces.d.ts

@@ -420,6 +420,133 @@ interface IUpdateFormsData {
  * Contains an array of data form objects with the following values
  */
 type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeText | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | IBodyTypeRadioButtonList | Record<string, unknown>;
+/**
+ * Value shapes accepted by a SUBMISSION (`POST /form-data`).
+ *
+ * For three field kinds they are not the shapes a page attribute uses, and a
+ * body written from the read types is refused. Measured on
+ * rwah2o.oneentry.cloud, 2026-09-12 and again 2026-09-28 (CMS-888).
+ *
+ * `list` takes a list of strings; the `[{ title, value }]` form of a page
+ * attribute answers `400 formData's marker '<marker>' value[0] must be a string`.
+ *
+ * `text` takes a one-element array holding exactly ONE of `plainValue`,
+ * `htmlValue` or `mdValue`, and no `params`. The object form answers
+ * `400 … value must be an array`, `params` answers `… is not allowed`, and two
+ * representations answer `Only one of htmlValue, plainValue or mdValue can be provided`.
+ *
+ * `spam` takes the captcha event, not the bare token.
+ */
+type FormDataPostType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyPostTypeText | IBodyPostTypeList | IBodyPostTypeSpam | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | Record<string, unknown>;
+/**
+ * Represents a `list` field of a form SUBMISSION.
+ * @interface IBodyPostTypeList
+ * @property {string} marker - marker name. Example: "recipient".
+ * @property {string} type - Type value. Example: "list".
+ * @property {string[]} value - Chosen options as plain strings. Example: ["Tom Hoffart"].
+ * @example
+    {
+      "marker": "recipient",
+      "type": "list",
+      "value": ["Tom Hoffart"]
+    }
+ * @description A submission sends the chosen options as strings. The `[{ title, value }]`
+ * shape a page attribute stores is refused here with `value[0] must be a string`.
+ */
+interface IBodyPostTypeList {
+    marker: string;
+    type: 'list';
+    value: string[];
+}
+/**
+ * Represents a `text` field of a form SUBMISSION.
+ * @interface IBodyPostTypeText
+ * @property {string} marker - marker name. Example: "your_message".
+ * @property {string} type - Type value. Example: "text".
+ * @property {ITextSubmissionValue[]} value - One-element array holding exactly one representation.
+ * @example
+    {
+      "marker": "your_message",
+      "type": "text",
+      "value": [{ "plainValue": "Hello" }]
+    }
+ * @description The array holds one object carrying exactly one of `plainValue`,
+ * `htmlValue` or `mdValue`. Editor `params` are refused, and so is sending two
+ * representations at once.
+ */
+interface IBodyPostTypeText {
+    marker: string;
+    type: 'text';
+    value: ITextSubmissionValue[];
+}
+/**
+ * @interface ITextSubmissionValuePlain
+ * @property {string} plainValue - Plain-text representation. Example: "Hello".
+ * @description Plain-text branch of a submitted text value.
+ */
+interface ITextSubmissionValuePlain {
+    plainValue: string;
+}
+/**
+ * @interface ITextSubmissionValueHtml
+ * @property {string} htmlValue - HTML representation. Example: "<p>Hello</p>".
+ * @description HTML branch of a submitted text value.
+ */
+interface ITextSubmissionValueHtml {
+    htmlValue: string;
+}
+/**
+ * @interface ITextSubmissionValueMd
+ * @property {string} mdValue - Markdown representation. Must not be empty. Example: "**Hello**".
+ * @description Markdown branch of a submitted text value.
+ */
+interface ITextSubmissionValueMd {
+    mdValue: string;
+}
+/**
+ * Exactly one representation of a submitted text value.
+ */
+type ITextSubmissionValue = ITextSubmissionValuePlain | ITextSubmissionValueHtml | ITextSubmissionValueMd;
+/**
+ * Represents a `spam` (captcha) field of a form SUBMISSION.
+ * @interface IBodyPostTypeSpam
+ * @property {string} marker - marker name. Example: "spam".
+ * @property {string} type - Type value. Example: "spam".
+ * @property {ICaptchaValue} value - The captcha event, not the bare token.
+ * @example
+    {
+      "marker": "spam",
+      "type": "spam",
+      "value": { "event": { "token": "<reCAPTCHA v3 token>", "siteKey": "6Ldjk7Yt…" } }
+    }
+ * @description The field carries a reCAPTCHA v3 token obtained in the browser.
+ * A bare string is refused with the same sentence as a wrong token —
+ * `Captcha Validation Failed, captcha type is: google` — so a malformed value
+ * is indistinguishable from a bot.
+ */
+interface IBodyPostTypeSpam {
+    marker: string;
+    type: 'spam';
+    value: ICaptchaValue;
+}
+/**
+ * @interface ICaptchaEvent
+ * @property {string} token - The token issued by the captcha provider in the browser.
+ * @property {string} siteKey - The site key the token was issued for. Example: "6Ldjk7Yt…".
+ * @description The captcha payload of a `spam` field.
+ */
+interface ICaptchaEvent {
+    token: string;
+    siteKey: string;
+}
+/**
+ * @interface ICaptchaValue
+ * @property {ICaptchaEvent} event - The captcha payload.
+ * @description Wrapper the platform expects around the captcha payload.
+ */
+interface ICaptchaValue {
+    event: ICaptchaEvent;
+}
 /**
  * Represents the structure of the body for posting form data.
  * @interface IBodyPostFormData
@@ -428,7 +555,7 @@ type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeTe
  * @property {string} moduleEntityIdentifier - Text identifier (marker) of the module entity. Example: "blog".
  * @property {string | null} replayTo - Email to reply to. Example: "some@email.com".
  * @property {string} status - Status of the form. Example: "sent".
- * @property {FormDataType[]} formData - Array of form data objects.
+ * @property {FormDataPostType[]} formData - Array of form data objects. A submission's value shapes differ from the read shapes — see FormDataPostType.
  * @example
     [
       {
@@ -455,7 +582,7 @@ interface IBodyPostFormData {
     moduleEntityIdentifier: string;
     replayTo: string | null;
     status: string;
-    formData: FormDataType[];
+    formData: FormDataPostType[];
     fileQuery?: IUploadingQuery;
 }
 /**
@@ -711,4 +838,4 @@ interface IListOptionValue {
     value: string;
     extended: IListOptionExtended;
 }
-export type { FormDataStatus, FormDataType, IBodyPostFormData, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };
+export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };

package/dist/search/searchApi.d.ts

@@ -26,10 +26,11 @@ export default class SearchApi extends AsyncModules implements ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }

package/dist/search/searchApi.js

@@ -64,19 +64,23 @@ class SearchApi extends asyncModules_1.default {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    async globalSearch(query, types, visibility, offset, limit) {
+    async globalSearch(query, types, visibility, offset, limit, langCode = this.state.lang) {
         // `types` is sent comma-separated — the array stringifies to exactly that.
+        // `langCode` is not optional decoration: the index is per language, and
+        // without it a word of a second locale answers an empty group (CMS-912).
         const params = {
             q: query,
             types,
             visibility,
             offset,
             limit,
+            langCode,
         };
         const data = await this._fetchGet(`?` + this._queryParamsToString(params));
         const validated = await this._validateResponse(data, schema('GlobalSearchResponseSchema'));