oneentry 1.0.167 → 1.0.169

package/dist/search/searchInterfaces.d.ts

@@ -13,11 +13,12 @@ interface ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }
 /**
  * Entity type a global search group or item belongs to.

package/dist/users/usersApi.js

@@ -147,9 +147,9 @@ class UsersApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/users/updateUser updateUser} documentation.
      */
     async updateUser(body, langCode = this.state.lang) {
-        if (!('langCode' in body))
-            body['langCode'] = langCode;
-        const result = await this._fetchPut('/me', this._normalizePostBody(body, langCode));
+        // The language goes onto our own copy; the caller's body is left alone (CMS-909).
+        const payload = 'langCode' in body ? body : { ...body, langCode };
+        const result = await this._fetchPut('/me', this._normalizePostBody(payload, langCode));
         const validated = await this._validateResponse(result, schema('UpdateUserResponseSchema'));
         return validated;
     }

package/esm/auth-provider/authProviderApi.js

@@ -86,8 +86,9 @@ export default class AuthProviderApi extends AsyncModules {
      * @see {@link https://js-sdk.oneentry.cloud/docs/auth-provider/signUp signUp} documentation.
      */
     async signUp(marker, body, langCode = this.state.lang) {
-        body['langCode'] = langCode;
-        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody(body, langCode));
+        // `langCode` goes onto our own copy — the caller's body stays as it was
+        // given, so a retry or a second parallel call sends the same thing (CMS-909).
+        const result = await this._fetchPost(`/marker/${marker}/users/sign-up`, this._normalizePostBody({ ...body, langCode }, langCode));
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('SignUpResponseSchema'));
         return this._normalizeData(validated);

package/esm/base/asyncModules.d.ts

@@ -103,13 +103,19 @@ export default abstract class AsyncModules extends SyncModules {
      */
     private makeOptions;
     /**
-     * Reads a response body as JSON, tolerating an empty body.
+     * Reads an error response body as JSON, tolerating an empty body.
      *
      * `Response.json()` throws on an empty body (e.g. 204 or an empty error
      * payload); this helper mirrors the OK-path guard (`text ? JSON.parse : {}`)
      * so both the success and the error branches handle empty bodies the same way.
+     *
+     * A body that is present but is not JSON — a gateway's HTML page in front of a
+     * 502, the platform's own admin page (CMS-957) — used to collapse into `{}`,
+     * which carries no `statusCode` and therefore does not read as an error at all:
+     * a failed request came back looking like an empty success. It is described
+     * instead, keeping the status the server actually sent.
      * @param {Response} response - The fetch Response to read.
-     * @returns {Promise<unknown>} Parsed JSON, or an empty object when the body is empty/unparsable.
+     * @returns {Promise<unknown>} Parsed JSON, `{}` for an empty body, or a described error for a body that is not JSON.
      */
     private _parseJson;
     /**
@@ -120,4 +126,42 @@ export default abstract class AsyncModules extends SyncModules {
      * @description Define an asynchronous method 'browserResponse' that takes a path and options as parameters
      */
     private browserResponse;
+    /**
+     * Describes a response whose body is not the JSON the API is supposed to send.
+     *
+     * The platform has been seen answering `200 OK` with `content-type: text/html`
+     * and the admin page as the body — every content endpoint at once, for minutes
+     * (CMS-957). A successful status carrying someone else's body is indistinguishable
+     * from a real answer by status alone, and the only symptom used to be
+     * `SyntaxError: Unexpected token '<'` from the JSON parser: a message about the
+     * SDK's own parsing rather than about what the platform did. Callers read that as
+     * "this record does not exist" and a static build baked 404s over live products.
+     *
+     * The returned error names the received content type, the HTTP status and the
+     * first characters of the body, so a log line says what arrived instead of JSON.
+     * `statusCode` stays `0` — the request produced no usable answer, the same
+     * contract as a dropped connection, and a value no HTTP answer uses.
+     * @param {Response} response - The response whose body could not be parsed.
+     * @param {string} text - The raw body as read.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _nonJsonError;
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    private _toShellError;
 }

package/esm/base/asyncModules.js

@@ -201,8 +201,14 @@ export default class AsyncModules extends SyncModules {
         });
         // Check if the response status is OK (status code 200-299)
         if (response.ok) {
-            // Parse the response body as JSON and store the result
-            const result = await response.json();
+            // Parsed through the shared helper rather than `response.json()`: a `200` whose body is
+            // not JSON (CMS-957) threw a raw SyntaxError out of the refresh and took the request that
+            // triggered it with it. A body without tokens is a failed refresh, reported as such.
+            const result = await this._parseJson(response);
+            if (typeof (result === null || result === void 0 ? void 0 : result.refreshToken) !== 'string' ||
+                typeof (result === null || result === void 0 ? void 0 : result.accessToken) !== 'string') {
+                return false;
+            }
             // Update the state's refreshToken and accessToken with the new tokens from the response
             this.state.refreshToken = result.refreshToken;
             this.state.accessToken = result.accessToken;
@@ -275,22 +281,37 @@ export default class AsyncModules extends SyncModules {
         return options;
     }
     /**
-     * Reads a response body as JSON, tolerating an empty body.
+     * Reads an error response body as JSON, tolerating an empty body.
      *
      * `Response.json()` throws on an empty body (e.g. 204 or an empty error
      * payload); this helper mirrors the OK-path guard (`text ? JSON.parse : {}`)
      * so both the success and the error branches handle empty bodies the same way.
+     *
+     * A body that is present but is not JSON — a gateway's HTML page in front of a
+     * 502, the platform's own admin page (CMS-957) — used to collapse into `{}`,
+     * which carries no `statusCode` and therefore does not read as an error at all:
+     * a failed request came back looking like an empty success. It is described
+     * instead, keeping the status the server actually sent.
      * @param {Response} response - The fetch Response to read.
-     * @returns {Promise<unknown>} Parsed JSON, or an empty object when the body is empty/unparsable.
+     * @returns {Promise<unknown>} Parsed JSON, `{}` for an empty body, or a described error for a body that is not JSON.
      */
     async _parseJson(response) {
+        let text;
         try {
-            const text = await response.text();
-            return text ? JSON.parse(text) : {};
+            text = await response.text();
         }
         catch {
             return {};
         }
+        if (!text) {
+            return {};
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return this._nonJsonError(response, text);
+        }
     }
     /**
      * Handles responses from the browser's fetch API.
@@ -348,10 +369,18 @@ export default class AsyncModules extends SyncModules {
             // Check if the response status is OK (status code 200-299)
             if (response.ok) {
                 // Read the body as text; if it is empty return an empty object,
-                // otherwise parse it as JSON. A parse failure propagates to the
-                // catch below and is handled according to isShell.
+                // otherwise parse it as JSON. A body that is not JSON is turned into a
+                // described error by `_nonJsonError` and handled according to isShell.
                 const text = await response.text();
-                return (text ? JSON.parse(text) : {});
+                if (!text) {
+                    return {};
+                }
+                try {
+                    return JSON.parse(text);
+                }
+                catch {
+                    throw this._nonJsonError(response, text);
+                }
             }
             // Handle non-OK responses (applies to the first response and to a failed retry).
             const status = response.status;
@@ -372,11 +401,78 @@ export default class AsyncModules extends SyncModules {
             // Handle any errors that occur during the fetch process
             // Determine whether to return or throw the error based on 'isShell' state
             if (this.state.isShell) {
-                return e;
+                return this._toShellError(e);
             }
             else {
                 throw e;
             }
         }
     }
+    /**
+     * Describes a response whose body is not the JSON the API is supposed to send.
+     *
+     * The platform has been seen answering `200 OK` with `content-type: text/html`
+     * and the admin page as the body — every content endpoint at once, for minutes
+     * (CMS-957). A successful status carrying someone else's body is indistinguishable
+     * from a real answer by status alone, and the only symptom used to be
+     * `SyntaxError: Unexpected token '<'` from the JSON parser: a message about the
+     * SDK's own parsing rather than about what the platform did. Callers read that as
+     * "this record does not exist" and a static build baked 404s over live products.
+     *
+     * The returned error names the received content type, the HTTP status and the
+     * first characters of the body, so a log line says what arrived instead of JSON.
+     * `statusCode` stays `0` — the request produced no usable answer, the same
+     * contract as a dropped connection, and a value no HTTP answer uses.
+     * @param {Response} response - The response whose body could not be parsed.
+     * @param {string} text - The raw body as read.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _nonJsonError(response, text) {
+        var _a, _b, _c;
+        const contentType = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : 'unknown';
+        const excerpt = text.trim().slice(0, 120).replace(/\s+/g, ' ');
+        return {
+            // A successful status carrying a non-JSON body produced no usable answer, the same
+            // contract as a dropped connection. A failing one already says something true about
+            // the request, so that status is kept.
+            statusCode: response.ok ? 0 : response.status,
+            message: `Expected JSON from the platform, received ${contentType} ` +
+                `(HTTP ${response.status}): ${excerpt}`,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    /**
+     * Turns whatever was thrown into the error shape the SDK already returns.
+     *
+     * With `isShell` on, a failure is returned rather than thrown — and a dropped
+     * connection throws a `TypeError`, whose `message` and `stack` are not
+     * enumerable. Returned as it was, it serializes to `{}` and reads exactly
+     * like an empty answer: on the sanbenitocog pilot such a value entered the
+     * page cache and was served for minutes after the link came back, and
+     * `next build` baked a site of 404s while reporting success (CMS-780).
+     *
+     * An object that already carries a `statusCode` is the platform's own error
+     * and is passed through untouched. Everything else becomes
+     * `{ statusCode: 0, message, pageData: null, timestamp }` — `statusCode: 0`
+     * says "the request never reached the platform", which no HTTP answer uses.
+     * @param {unknown} e - Whatever the try block threw.
+     * @returns {IError} The error in the shape the SDK returns for platform errors.
+     */
+    _toShellError(e) {
+        if (e && typeof e === 'object' && 'statusCode' in e) {
+            return e;
+        }
+        const message = e instanceof Error
+            ? `${e.name}: ${e.message}`
+            : typeof e === 'string'
+                ? e
+                : 'Request failed before a response was received';
+        return {
+            statusCode: 0,
+            message,
+            pageData: null,
+            timestamp: new Date().toISOString(),
+        };
+    }
 }

package/esm/base/syncModules.d.ts

@@ -81,10 +81,17 @@ export default abstract class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     protected _normalizePostBody(body: any, langCode?: string): any;
     /**

package/esm/base/syncModules.js

@@ -218,27 +218,38 @@ export default class SyncModules {
      * 2. **formData localization**: the API expects formData as
      * `{ "<langCode>": [...fields] }`, but callers pass a flat array or a single object.
      * The method wraps the data into the required structure.
-     * If `formData` is absent from the body — return the body as-is (only phoneSMS cleanup applied).
-     * @param {any} body - The body to normalize.
+     * If `formData` is absent from the body — return a copy with only the phoneSMS cleanup applied.
+     *
+     * **The caller's object is never touched.** Methods that post a body are
+     * routinely called with one that is reused — a retry wrapper, two parallel
+     * calls, a shared default. Normalizing in place sends the already-wrapped
+     * value the second time, it is wrapped again, and the platform answers
+     * `400 "formData.en_US[0].marker" is required` about a field the caller
+     * never sent (CMS-909).
+     * @param {any} body - The body to normalize. Left unchanged.
      * @param {string} [langCode] - The language code for normalization.
-     * @returns {any} Normalized body.
+     * @returns {any} A normalized copy of the body.
      */
     _normalizePostBody(body, langCode = this.state.lang) {
-        // API does not accept phoneSMS = '' — delete the field if empty.
-        if (body.notificationData && body.notificationData.phoneSMS === '') {
-            delete body.notificationData.phoneSMS;
+        const next = { ...body };
+        // API does not accept phoneSMS = '' — drop the field if empty. `notificationData`
+        // is copied too: deleting the key on the original would reach the caller.
+        if (next.notificationData && next.notificationData.phoneSMS === '') {
+            next.notificationData = { ...next.notificationData };
+            delete next.notificationData.phoneSMS;
         }
         // If formData is not provided — no further normalization needed.
-        if (!body.formData)
-            return body;
+        if (!next.formData)
+            return next;
         // Wrap form fields in an object keyed by locale:
         // [{ marker, value }]  →  { "en_US": [{ marker, value }] }
-        const formData = {};
-        formData[langCode] = Array.isArray(body.formData)
-            ? body.formData
-            : [body.formData];
-        body.formData = formData;
-        return body;
+        // The fields themselves are reused by reference — they are not modified.
+        next.formData = {
+            [langCode]: Array.isArray(next.formData)
+                ? next.formData
+                : [next.formData],
+        };
+        return next;
     }
     /**
      * Normalizes the value of a single attribute in place.

package/esm/discounts/discountsApi.d.ts

@@ -1,7 +1,7 @@
 import AsyncModules from '../base/asyncModules.js';
 import type StateModule from '../base/stateModule.js';
 import type { IError } from '../base/utils.js';
-import type { IBonusBalanceEntity, IBonusTransactionEntity, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces.js';
+import type { IBonusBalanceEntity, IBonusHistoryResponse, IBonusTransactionType, ICouponValidationResult, IDiscountsApi, IDiscountsEntity, IDiscountsResponse, IDiscountsVectorSearch, IDiscountType } from './discountsInterfaces.js';
 /**
  * Controllers for working with events
  * @handle /api/content/events
@@ -63,11 +63,11 @@ export default class DiscountsApi extends AsyncModules implements IDiscountsApi
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Validate discounts coupon
      * @handleName validateDiscountsCoupon

package/esm/discounts/discountsApi.js

@@ -80,7 +80,7 @@ export default class DiscountsApi extends AsyncModules {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/discounts/getBonusHistory getBonusHistory} documentation.
      */

package/esm/discounts/discountsInterfaces.d.ts

@@ -55,10 +55,10 @@ interface IDiscountsApi {
      * @param {number} [discountId] - Discount id filter.
      * @param {number} [moduleId] - Module id filter.
      * @param {boolean} [isAdmin] - Admin filter.
-     * @returns {Promise<IBonusTransactionEntity[] | IError>} Returns array of bonus transactions or an error object.
+     * @returns {Promise<IBonusHistoryResponse | IError>} Returns the container with the transactions and their total, or an error object.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      */
-    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusTransactionEntity[] | IError>;
+    getBonusHistory(type?: IBonusTransactionType, dateFrom?: string, dateTo?: string, discountId?: number, moduleId?: number, isAdmin?: boolean): Promise<IBonusHistoryResponse | IError>;
     /**
      * Semantic (vector) search for discounts.
      * @handleName getDiscountsByVectorSearch
@@ -284,6 +284,18 @@ interface IBonusTransactionEntity {
     expiresAt?: string;
     createdAt?: string;
 }
+/**
+ * @interface IBonusHistoryResponse
+ * @property {IBonusTransactionEntity[]} items - The transactions of the current page.
+ * @property {number} total - How many transactions the filter matches in total.
+ * @description Container the bonus history arrives in. The endpoint answers
+ * `{ items, total }`, not a bare array — measured on the SDK test stand,
+ * 2026-09-28: an account with no transactions answers `{"items":[],"total":0}`.
+ */
+interface IBonusHistoryResponse {
+    items: IBonusTransactionEntity[];
+    total: number;
+}
 /**
  * @interface IBonusBalanceEntity
  * @description Represents the balance of bonus points.
@@ -292,4 +304,4 @@ interface IBonusTransactionEntity {
 interface IBonusBalanceEntity {
     balance: number;
 }
-export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };
+export type { IBonusBalanceEntity, IBonusHistoryQuery, IBonusHistoryResponse, IBonusTransactionEntity, IBonusTransactionType, ICouponEntity, ICouponValidationResult, IDiscountByMarkerQuery, IDiscountCondition, IDiscountsApi, IDiscountsEntity, IDiscountsQuery, IDiscountsResponse, IDiscountsValidateCoupon, IDiscountsVectorSearch, IDiscountType, IDiscountValue, };

package/esm/forms-data/formsDataInterfaces.d.ts

@@ -420,6 +420,133 @@ interface IUpdateFormsData {
  * Contains an array of data form objects with the following values
  */
 type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeText | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | IBodyTypeRadioButtonList | Record<string, unknown>;
+/**
+ * Value shapes accepted by a SUBMISSION (`POST /form-data`).
+ *
+ * For three field kinds they are not the shapes a page attribute uses, and a
+ * body written from the read types is refused. Measured on
+ * rwah2o.oneentry.cloud, 2026-09-12 and again 2026-09-28 (CMS-888).
+ *
+ * `list` takes a list of strings; the `[{ title, value }]` form of a page
+ * attribute answers `400 formData's marker '<marker>' value[0] must be a string`.
+ *
+ * `text` takes a one-element array holding exactly ONE of `plainValue`,
+ * `htmlValue` or `mdValue`, and no `params`. The object form answers
+ * `400 … value must be an array`, `params` answers `… is not allowed`, and two
+ * representations answer `Only one of htmlValue, plainValue or mdValue can be provided`.
+ *
+ * `spam` takes the captcha event, not the bare token.
+ */
+type FormDataPostType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyPostTypeText | IBodyPostTypeList | IBodyPostTypeSpam | IBodyTypeTextWithHeader | IBodyTypeImageGroupOfImages | IBodyTypeFile | Record<string, unknown>;
+/**
+ * Represents a `list` field of a form SUBMISSION.
+ * @interface IBodyPostTypeList
+ * @property {string} marker - marker name. Example: "recipient".
+ * @property {string} type - Type value. Example: "list".
+ * @property {string[]} value - Chosen options as plain strings. Example: ["Tom Hoffart"].
+ * @example
+    {
+      "marker": "recipient",
+      "type": "list",
+      "value": ["Tom Hoffart"]
+    }
+ * @description A submission sends the chosen options as strings. The `[{ title, value }]`
+ * shape a page attribute stores is refused here with `value[0] must be a string`.
+ */
+interface IBodyPostTypeList {
+    marker: string;
+    type: 'list';
+    value: string[];
+}
+/**
+ * Represents a `text` field of a form SUBMISSION.
+ * @interface IBodyPostTypeText
+ * @property {string} marker - marker name. Example: "your_message".
+ * @property {string} type - Type value. Example: "text".
+ * @property {ITextSubmissionValue[]} value - One-element array holding exactly one representation.
+ * @example
+    {
+      "marker": "your_message",
+      "type": "text",
+      "value": [{ "plainValue": "Hello" }]
+    }
+ * @description The array holds one object carrying exactly one of `plainValue`,
+ * `htmlValue` or `mdValue`. Editor `params` are refused, and so is sending two
+ * representations at once.
+ */
+interface IBodyPostTypeText {
+    marker: string;
+    type: 'text';
+    value: ITextSubmissionValue[];
+}
+/**
+ * @interface ITextSubmissionValuePlain
+ * @property {string} plainValue - Plain-text representation. Example: "Hello".
+ * @description Plain-text branch of a submitted text value.
+ */
+interface ITextSubmissionValuePlain {
+    plainValue: string;
+}
+/**
+ * @interface ITextSubmissionValueHtml
+ * @property {string} htmlValue - HTML representation. Example: "<p>Hello</p>".
+ * @description HTML branch of a submitted text value.
+ */
+interface ITextSubmissionValueHtml {
+    htmlValue: string;
+}
+/**
+ * @interface ITextSubmissionValueMd
+ * @property {string} mdValue - Markdown representation. Must not be empty. Example: "**Hello**".
+ * @description Markdown branch of a submitted text value.
+ */
+interface ITextSubmissionValueMd {
+    mdValue: string;
+}
+/**
+ * Exactly one representation of a submitted text value.
+ */
+type ITextSubmissionValue = ITextSubmissionValuePlain | ITextSubmissionValueHtml | ITextSubmissionValueMd;
+/**
+ * Represents a `spam` (captcha) field of a form SUBMISSION.
+ * @interface IBodyPostTypeSpam
+ * @property {string} marker - marker name. Example: "spam".
+ * @property {string} type - Type value. Example: "spam".
+ * @property {ICaptchaValue} value - The captcha event, not the bare token.
+ * @example
+    {
+      "marker": "spam",
+      "type": "spam",
+      "value": { "event": { "token": "<reCAPTCHA v3 token>", "siteKey": "6Ldjk7Yt…" } }
+    }
+ * @description The field carries a reCAPTCHA v3 token obtained in the browser.
+ * A bare string is refused with the same sentence as a wrong token —
+ * `Captcha Validation Failed, captcha type is: google` — so a malformed value
+ * is indistinguishable from a bot.
+ */
+interface IBodyPostTypeSpam {
+    marker: string;
+    type: 'spam';
+    value: ICaptchaValue;
+}
+/**
+ * @interface ICaptchaEvent
+ * @property {string} token - The token issued by the captcha provider in the browser.
+ * @property {string} siteKey - The site key the token was issued for. Example: "6Ldjk7Yt…".
+ * @description The captcha payload of a `spam` field.
+ */
+interface ICaptchaEvent {
+    token: string;
+    siteKey: string;
+}
+/**
+ * @interface ICaptchaValue
+ * @property {ICaptchaEvent} event - The captcha payload.
+ * @description Wrapper the platform expects around the captcha payload.
+ */
+interface ICaptchaValue {
+    event: ICaptchaEvent;
+}
 /**
  * Represents the structure of the body for posting form data.
  * @interface IBodyPostFormData
@@ -428,7 +555,7 @@ type FormDataType = IBodyTypeStringNumberFloat | IBodyTypeTimeDate | IBodyTypeTe
  * @property {string} moduleEntityIdentifier - Text identifier (marker) of the module entity. Example: "blog".
  * @property {string | null} replayTo - Email to reply to. Example: "some@email.com".
  * @property {string} status - Status of the form. Example: "sent".
- * @property {FormDataType[]} formData - Array of form data objects.
+ * @property {FormDataPostType[]} formData - Array of form data objects. A submission's value shapes differ from the read shapes — see FormDataPostType.
  * @example
     [
       {
@@ -455,7 +582,7 @@ interface IBodyPostFormData {
     moduleEntityIdentifier: string;
     replayTo: string | null;
     status: string;
-    formData: FormDataType[];
+    formData: FormDataPostType[];
     fileQuery?: IUploadingQuery;
 }
 /**
@@ -711,4 +838,4 @@ interface IListOptionValue {
     value: string;
     extended: IListOptionExtended;
 }
-export type { FormDataStatus, FormDataType, IBodyPostFormData, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };
+export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };

package/esm/search/searchApi.d.ts

@@ -26,10 +26,11 @@ export default class SearchApi extends AsyncModules implements ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }

package/esm/search/searchApi.js

@@ -26,19 +26,23 @@ export default class SearchApi extends AsyncModules {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      * @see {@link https://js-sdk.oneentry.cloud/docs/search/globalSearch globalSearch} documentation.
      */
-    async globalSearch(query, types, visibility, offset, limit) {
+    async globalSearch(query, types, visibility, offset, limit, langCode = this.state.lang) {
         // `types` is sent comma-separated — the array stringifies to exactly that.
+        // `langCode` is not optional decoration: the index is per language, and
+        // without it a word of a second locale answers an empty group (CMS-912).
         const params = {
             q: query,
             types,
             visibility,
             offset,
             limit,
+            langCode,
         };
         const data = await this._fetchGet(`?` + this._queryParamsToString(params));
         const validated = await this._validateResponse(data, schema('GlobalSearchResponseSchema'));

package/esm/search/searchInterfaces.d.ts

@@ -13,11 +13,12 @@ interface ISearchApi {
      * @param {'all' | 'visible' | 'hidden'} [visibility] - Visibility filter of the searched records. Default: "all".
      * @param {number} [offset] - Drilldown mode offset. Pass it only together with a single accessible type in `types`.
      * @param {number} [limit] - Drilldown mode page size. Pass it only together with a single accessible type in `types`, otherwise the API answers 400 "Drilldown mode (limit/offset) requires exactly one accessible type in `types`". Without it every group is returned in full.
+     * @param {string} [langCode] - Language code. Default: "en_US". The search index is per language: a word of a second locale is found only when its own langCode is sent (CMS-912).
      * @returns {Promise<IGlobalSearchResponse | IError>} Returns the query and the found records grouped by entity type.
      * @throws {IError} When isShell=false and an error occurs during the fetch
-     * @description Searches names and attribute values of visible records across entity types.
+     * @description Searches names and attribute values of visible records across entity types. The index is per language — the request carries `langCode`, so a bilingual project finds a word of either locale.
      */
-    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number): Promise<IGlobalSearchResponse | IError>;
+    globalSearch(query: string, types?: TGlobalSearchEntityType[], visibility?: 'all' | 'visible' | 'hidden', offset?: number, limit?: number, langCode?: string): Promise<IGlobalSearchResponse | IError>;
 }
 /**
  * Entity type a global search group or item belongs to.