oneentry 1.0.175 → 1.0.177

package/README.md

@@ -86,7 +86,7 @@ const api = defineOneEntry('your-url', config)
 
 The second parameter of the constructor takes the 'config'. It contains the following values:
 
-- 'token' - Set the token key if your project secure "Security API Token". If you are using certificate protection, do not pass this variable. You can read more about the security of your project [here](https://oneentry.cloud/instructions).
+- 'token' - The app token of your project ("Security API Token"). Required in every setup: `defineOneEntry` throws without it, certificate protection included. You can read more about the security of your project [here](https://oneentry.cloud/instructions).
 
 - 'langCode' - Set the "langCode" to set the default language. By specifying this parameter once, you don't have to pass the langCode to the methods ONEENTRY API. If you have not passed the default language, it will be set "en_US".
 
@@ -130,6 +130,7 @@ An example of a configuration that is protected with a certificate allows you to
 
 ```js
 const api = defineOneEntry('https://my-project.oneentry.cloud', {
+    token: 'my-token',
     langCode: 'en_US',
     traficLimit: true,
     auth: {
@@ -148,7 +149,7 @@ This method (setAccessToken) should not be called if the method does not require
 const user = api.Users.setAccessToken('my.access.token').getUser()
 ```
 
-> If you chose token protection to ensure connection security, just pass your token to the function as an optional parameter.
+> The token is required: pass your project's app token in every setup.
 
 You can get a token as follows
 
@@ -159,7 +160,7 @@ You can get a token as follows
 5. Log in to the project, go to the settings section and open the token tab
 6. Get and copy the token of your project
 
-You can also connect a tls certificate to protect your project. In this case, do not pass the "token" at all. When using the certificate, set up a proxy in your project. Pass an empty string as an url parameter.
+You can also connect a tls certificate to protect your project; the "token" is still required. When using the certificate, set up a proxy in your project and pass its URL as the url parameter — an absolute URL, or in the browser a path on your site such as `/oneentry`.
 [Learn more about security](https://oneentry.cloud/instructions)
 
 ```js
@@ -179,6 +180,8 @@ const api = defineOneEntry('your-url', {
 })
 ```
 
+> **Server-side rendering.** A client holds one session: after `AuthProvider.auth` (or with `auth.refreshToken`) every call of that client is made as that user. On a server, never sign in on a client shared between requests — the next visitor gets the previous one's profile and cart. Create a client per request for user calls (and pass `guestId` per visitor). A refresh token is bound to the device metadata it was issued with: store `getDeviceMetadata()` next to it and pass it back as `deviceMetadata`.
+
 ## TypeScript Types
 
 All public interfaces and types are re-exported from the package root, so deep paths are not needed:
@@ -203,7 +206,9 @@ OneEntry SDK supports optional validation of API responses using Zod. This featu
 
 Zod and the response schemas are loaded on demand, the first time a response actually has to be validated. Leaving validation off — the default — keeps them out of the code your app loads. Socket.io is deferred the same way, until the first `WS.connect()`.
 
-Together that means a project calling a single SDK method loads about **43 kB minified (9.7 kB gzip)** instead of 536 kB, with Zod, the schemas and Socket.io landing in chunks that are never requested. The SDK is published as both CommonJS and ESM (`sideEffects: false`), so bundlers can tree-shake the rest.
+Together that means a project importing `defineOneEntry` from the ESM build loads about **58 kB minified (12 kB gzip)** (esbuild, 1.0.177) instead of hundreds of kilobytes, with Zod, the schemas and Socket.io landing in chunks that are never requested. This holds for the ESM build only: a bundler that resolves the CommonJS build (`require('oneentry')`) cannot split the deferred `require` calls and bundles Zod and Socket.io as well. `defineOneEntry` creates every module, so all of them are in the bundle; tree-shaking (`sideEffects: false`) drops only the helpers you do not import (`isFileAttribute`, `expandTimeIntervals`, …).
+
+TypeScript 5.0 or later is required for the type definitions (Zod 4 types do not parse on 4.x).
 
 ### Attribute Values
 
@@ -214,6 +219,7 @@ import { defineOneEntry, getAttributeFile, getAttributeFiles } from 'oneentry'
 
 const { Pages } = defineOneEntry('your-url', { token: 'your-app-token' })
 const page = await Pages.getPageByUrl('catalog')
+if ('statusCode' in page) throw new Error(page.message) // IError — see Errors
 
 // Same call whether the attribute holds one file or a gallery.
 const images = getAttributeFiles(page.attributeValues.gallery) // IAttributeFile[]
@@ -232,6 +238,7 @@ import { defineOneEntry, expandAttributeTimeIntervals } from 'oneentry'
 
 const { Pages } = defineOneEntry('your-url', { token: 'your-app-token' })
 const page = await Pages.getPageByUrl('booking')
+if ('statusCode' in page) throw new Error(page.message) // IError — see Errors
 
 const slots = expandAttributeTimeIntervals(page.attributeValues.interval, {
     from: '2025-04-01',
@@ -307,5 +314,5 @@ Now you can use the following links to jump to specific entries documentation:
 - [UserActivity](https://js-sdk.oneentry.cloud/docs/category/useractivity)
 - [UserGroups](https://js-sdk.oneentry.cloud/docs/category/usergroups)
 - [Users](https://js-sdk.oneentry.cloud/docs/category/users-1)
-- [WS](https://js-sdk.oneentry.cloud/docs/category/web-socket)
+- [WS](https://js-sdk.oneentry.cloud/docs/category/ws)
 - [Advanced examples](https://js-sdk.oneentry.cloud/docs/category/usage-examples)

package/changelog.md

@@ -1,5 +1,145 @@
 # SDK Change Log
 
+## v.1.0.177
+
+### What's Changed
+
+- **`Products.getProductBlockById(id, langCode?)` takes a language** (CMS-1151). It sent no `langCode` and unwrapped the answer by the client's language, so with a client on another language `localizeInfos` and `attributeValues` of the blocks stayed keyed by locale.
+- **`IOrderProducts.previewImage` is `IPicture | IPicture[] | null`**: a product without a preview comes as `[]`, not `null` (CMS-1113).
+- **`IntegrationCollections.getICollectionRowsByMarker(marker, langCode?, userQuery?)` pages its answer** (CMS-1163). Without paging the endpoint returns the first 30 rows only (`total: 214` on the test project); `userQuery` takes the same `limit`, `offset`, `entityType`, `entityId` as `getICollectionRowsById`.
+- **`ICollectionFormData.value` is `string | number | null`** (CMS-1163): on reading, `integer`/`float`/`real` fields come back as numbers, and as `null` when the stored value is not a number — the type said `string`.
+- **`Discounts.getBonusHistory` takes `offset` and `limit`** as its last two arguments (CMS-1130): the endpoint pages and validates them, the SDK could not pass them.
+- **AttributesSets types** (CMS-1166, CMS-1126): `IAttributesSets` declares all four methods (`getAttributes` and `getAttributeSetByMarker` were missing); `IAttributeSchemaItem` declares the sign-up and notification flags, `isProductPreview` and `previewTemplateId`; `additionalFields` of an attribute and of a schema item is `Record<string, IAttributeAdditionalField>` (`{ type, value }`), not a nested attribute; `IAttributesSetsEntity.multiselect` is declared and kept by validation — the schema used to drop it.
+- **`Payments.getSessionByOrderId` returns `ISessionEntity[] | IError`** (CMS-1171): the answer is always an array (`[]` for an order without sessions); the type allowed a single object. `Payments.getAccounts(langCode?)` and `getAccountById(id, langCode?)` take a language (CMS-1114).
+- **`FileUploading.getFile` returns `Promise<Response>`** (CMS-1175): it always resolved to the raw `Response` — also on a `404` — and never returned an `IError`; check `response.ok`.
+- **`IError.pageData` is optional**: the errors of the subscriptions module and of `/files/search` come without it (CMS-1178, CMS-1177). Reading `error.pageData` still compiles.
+- **`ISignUpEntity.oauthSub`** is declared and kept by validation (CMS-1123).
+- **Validation no longer changes the answer** (CMS-1186). With `validation.enabled` the SDK returned the object Zod had parsed, and `z.object` drops keys the schema does not describe — in strict and in non-strict mode alike, while non-strict promised the original data. A field the platform added (`weight` of a template preview proportion, `proportions.default.default`, any new field) vanished as soon as validation was on. The original object is returned now; validation only decides between it and the `422` error.
+- **`IAdminEntity.formModuleConfigs`** replaces `moduleFormConfigs` — the API key is `formModuleConfigs` (CMS-1132); a type-only change, the API never sent `moduleFormConfigs`. `isSync` of an admin tells whether it has attribute data in the requested language.
+- **`IProportion.weight` and `ITemplatesPreviewProportionVariants.default`** are declared (CMS-1132).
+- **`ISitemapQuery.baseUrls` is required** (CMS-1132, CMS-1100): without it the API generates nothing and answers `502`; `url`, `lastmod`, `changefreq` and `priority` are deprecated — the API ignores them.
+
+- **`WS.connect()` returns `Socket<IWsServerEvents>`** (CMS-1196): the `notification` payload is typed `IWsNotification` (`message`, `type`, `attributes`; other fields `unknown`); other event names stay untyped. `IWsNotification`, `IWsNotificationAttribute` and `IWsServerEvents` are exported.
+- **`isShell: false` throws an `IError` for a request that got no answer** (CMS-1192): a dropped connection used to escape as a raw `TypeError`; it is now `{ statusCode: 0, message, … }` with the original error in `cause`.
+- **An exception from an `errors.customErrors` handler reaches the caller** (CMS-1192), and an async handler is awaited. With `isShell: true` the exception (Next.js `redirect()`/`notFound()`) was swallowed into `{ statusCode: 0 }`.
+- **An unset `image`/`groupOfImages`/`file`/`timeInterval`/`date`/`dateTime`/`time` attribute is `null`** (CMS-1198): the API sends `""`, which the SDK kept, so `isFileAttribute` was `false` on an empty image. An entity attribute without a `value` key gets `null` again (1.0.177 left it without the key); form fields and attribute-set schemas still get no key.
+- **The project URL is normalized** (CMS-1194): trailing `/` and a copied `/api/content` are cut (every call answered `404`), a URL without `http://`/`https://` throws at `defineOneEntry`. `langCode: ''` counts as not set (`en_US`); `validation.strictMode` without `validation.enabled` warns.
+- **JSDoc of `IConfig`** (CMS-1194, CMS-1191): `auth.*` have their real types; `validation.*`, `errors.isShell`, `errors.customErrors` (supported codes) and the `langCode` default are described; `auth.refreshToken` explains that on the server the `deviceMetadata` saved with the token must be passed back.
+
+- **Public types** (CMS-1204): `IDefineApi` and 13 types used in fields of public interfaces (`IProductPriceRange`, `IProductPageRef`, `ICollectionFormData`, `IOrderProductsData`, `ISubscriptionItem`, …) are exported; `setAccessToken`/`setRefreshToken`/`setGuestId`/`setDeviceMetadata` return the module (`this`), not `any`; `auth.refreshToken` accepts `null` (`localStorage.getItem`); a `customErrors` handler gets a required `IError`.
+- **The project URL may be a proxy path** (`/oneentry`); a URL with a query or fragment throws at `defineOneEntry` (CMS-1194).
+- **Docs** (CMS-1203, CMS-1204): a client holds one user's session — on a server create one per request for user calls (README, manual, JSDoc of `defineOneEntry`); `guestId` must be a UUID v4; product counts do not depend on the language (CMS-1201); `getProductsByStatusMarker` returns the status, not products; README bundle size corrected (ESM ~58 kB / 12 kB gzip, the CommonJS build bundles Zod and Socket.io), TypeScript 5.0+ required.
+
+- **`IConfig.token` is required** in the type (CMS-1132): `defineOneEntry` already threw without it, while the type let it compile.
+- **A browser guest id is always a UUID v4** (CMS-1120): without `crypto.randomUUID` (a page over plain http) the SDK generated a base-36 id, which the platform silently replaces on every request — the guest cart was lost; a stored non-UUID guest id is replaced.
+
+- **`IOrderProducts.title` is `string | null`** (CMS-1206): a product without a translation in the order's language comes with `title: null`.
+- **A guest id that is not a UUID v4 is reported** (CMS-1120): `config.guestId` / `setGuestId` warn — the platform replaces any other value on every request.
+
+- **A payment session may have no order** (CMS-1070, CMS-1092): `ISessionEntity.orderId` is `number | null` — `subscribe` now creates a payment session, and it is not linked to an order. `getSessionByOrderId` gives `[]` for an order of another user.
+- **`IAdminEntity.identifier` is optional**: it was the admin's sign-in login, and the Content API no longer sends it (CMS-1053).
+- **`System.test404` and `System.test500` are deprecated**: the platform removed both endpoints, they answer `404 "Cannot GET …"` (CMS-1056).
+- **`BlockType` `'service'`**: the `type` filter of `getBlocks` and `getTemplateByType` takes it now; the note about a platform defect is gone (CMS-1073).
+
+### What's Fixed
+
+- **Schemas match the interfaces** (CMS-1206): `updateUser` in strict mode turned a successful empty answer into a `422`; `getActiveSessionsByMarker` is validated; `menuTitle: null` passes; attribute `listTitles`/`validators`/`additionalFields` and form `attributes` are required as in the types.
+- **`postFormsData` does not send a form whose file upload failed** (CMS-1192): the upload error went to the platform as the field's value and the caller got a success.
+- **Round 11 follow-ups**: `logout` retries with the current token itself instead of rewriting the retried body (a concurrent refresh left the session alive, and a form field equal to the token was rewritten too); `logout` and `WS.connect` respect the refresh block after a metadata rejection; `https:evil.example` (no `//`) is rejected; a site-root proxy opens the socket at the site root; only a UUID v4 stored guest id is kept; an empty or blank platform `message` becomes `HTTP <status>`; `active` follows the last queued `connect`/`disconnect`; README: `token` is required with a certificate too; broken `@see` links removed, README WS link fixed.
+- **The project URL is checked strictly** (CMS-1194): a backslash "proxy path" (`/\evil.example`) passed, and browsers sent every request with the app token to that host; credentials in the URL are rejected; `/` and `/api/content` mean the site itself.
+- **More follow-ups** (probe of 2026-10-30): a `401` retry of `logout` sends the rotated refresh token in its body, so `logout` mid-session works with `isShell: false` too and fires no `customErrors[400]`; `customErrors` is not called for the SDK's own sub-requests (page block products, page templates); a refresh rejected for its device metadata is not retried with the same metadata; `logoutAll`, `activateUser`, `changePassword`, `deleteFormsDataByid` read an empty 2xx as `true`; `""` → `null` applies to entity values only (form data of orders and users keeps `""`); a non-string `langCode` falls back to `en_US`; an empty server `message` falls back to `HTTP <status>`; a restored session refreshes before opening the socket (it connected as a guest); before Socket.io loads `off()` removes every listener and `active` turns false after a queued `disconnect()`.
+- **Pages keep errors out of their data** (CMS-1110, CMS-1200): a failed products request of a page block left the error object in `products`/`similarProducts` (now `[]` / `{ items: [], total: 0 }`), a failed template request left it in `page.template` (now no `template`).
+- **No request depends on `FormData`/`Blob`** (CMS-1204): without these globals every call, a GET included, threw `TypeError`.
+- **Follow-ups of this version's fixes** (probe of 2026-10-30): `logout` mid-session retries with the token the 401 refresh rotated; a `400` about `x-device-metadata` keeps the refresh token; the refresh timeout works without `AbortSignal.timeout`; a failing answer keeps the server's `message`; `logout`/`checkCode` read an empty 2xx as `true`; a locale map left by a missing translation gets no `value: null`; unset `list`/`radioButton`/`entity` are `null`; `langCode` of spaces falls back to `en_US`; the socket sends the current token on a manual `connect()` too, and before Socket.io loads `off` is honoured by `hasListeners`, `timeout().emitWithAck()` keeps its timeout, `'on' in socket` is `true`.
+- **The saved session** (CMS-1191):
+  - `AuthProvider.refresh(marker, token)` sends the token it was given once — on a restored session it first refreshed on its own, rotated that very token and answered `400`;
+  - `AuthProvider.logout(marker, token)` of a restored session logs out with the rotated token — it answered `400` and the session stayed alive;
+  - a refresh token rejected with `400` is dropped — each following request fired the same refresh first;
+  - the automatic refresh uses the provider of `auth`/`oauth`/`refresh`, not only `auth.providerMarker`;
+  - a refresh that does not answer within 30 s counts as failed — it held every request of the client.
+- **A failing answer is an `IError`** (CMS-1192): a non-OK response whose body is not the platform error (`{"error":…}`, `[]`, `null` from a gateway) was returned as data — `subscribeByMarker` reported a `503` as `true`.
+- **`attributeValues: null` / `attributes: null` no longer throw** past `isShell` (CMS-1193): one such record took down a whole list.
+- **`getPageById`, `getUserGroupById` encode the id, `offset`/`limit` are encoded in the query** (CMS-1150): `getPageById('../menus/marker/main_menu')` returned a menu as a page.
+- **WebSocket** (CMS-1121, CMS-1195, CMS-1196):
+  - the socket sends `x-device-metadata` — without it the platform registered every SDK socket as a guest, so personal notifications never arrived; the current token is sent on every reconnection (it kept the first one), a guest sends no `Bearer undefined`, and the token also goes in the handshake `auth` (browsers drop headers; the platform does not read it yet — CMS-1197);
+  - a path in the project URL is part of the socket path — it was read as a namespace (`Invalid namespace`);
+  - the stand-in returned before Socket.io loads: `JSON.stringify(socket)` no longer breaks the replay and loses the listeners, `emitWithAck` returns a Promise, `hasListeners`/`listeners` answer, `socket.io.on(…)` and `volatile` are queued, assignments (`socket.auth = …`) are applied, a failed load reaches `connect_error`.
+- **Orders calls in flight at once no longer go to the wrong base path** (CMS-1149). Refund, `getOrderById` and vector search live under `/api/content/orders`, and the module swapped its own base URL for the time of the request: a parallel `getAllOrdersByMarker` (`Promise.all` on an order page) went to `/api/content/orders/marker/…` and got `404`, and two overlapping swaps could leave the instance on `/api/content/orders` for good. Such calls go through a view with its own base URL now (`AsyncModules._withBaseUrl`); `Admins.getAdminsByVectorSearch` used the same swap and is fixed too.
+- **Page URLs, ids and `langCode` are encoded in the request URL** (CMS-1150). 1.0.176 encoded markers only:
+  - a page URL went into the path as is — `getProductsByPageUrl('../../all')` resolved to `POST /products/all`, the whole catalogue; it is encoded segment by segment now (`_pathSegments`, `/` kept) in `Products` and `Pages`;
+  - an id from a route parameter — `getOrderById('../orders-storage/marker/my_order')` returned the storage as an order, `'800?langCode=xx#'` replaced the query; ids in `Orders` and `Products` paths go through `_pathSegment`;
+  - `langCode` was glued into the query unencoded in about 50 places — `'en_US&limit=1'` added a parameter; it is encoded everywhere now.
+- **The language of the call reaches the normalization** (CMS-1151). `Orders` methods unwrapped the answer by the client's language, not by their `langCode` argument: `createOrder(…, 'ru_RU')` returned `formData: { "ru_RU": [ … ] }`. In `getProductsByIds` the `userQuery` no longer overrides the positional `ids` and `langCode`, and `getProductsByPageId`, `getProductsByPageUrl` and `getRelatedProductsById` build the query with one serializer — a `langCode` in `userQuery` was sent twice and answered `400`.
+- **A `401` without a refresh token is one request** (CMS-1152). Every `401` of a guest or of a wrong app token was followed by `POST …/users/refresh` with an empty body, answered `400`/`401`.
+- **JSDoc** (CMS-1153): `IProductAdditional.prices` is the price range of the whole catalogue, not of the product; `isNormalized` is deprecated — the API no longer reads it; the limits of `limit`, the handling of unknown and repeated `ids`, a wrong `signPrice` and the missing language fallback are described; `relatedIds` is marked optional; `config.token` of `defineOneEntry` is required.
+- **Blocks and Pages answer in the language of the call** (CMS-1160, CMS-1151). Every `Blocks` method, `Pages.getBlocksByPageUrl` with the products of its blocks, and the templates attached to pages unwrapped the answer by the client's language, not by their `langCode` argument — a call in another language returned `localizeInfos` and `attributeValues` still keyed by locale (`{ "en_US": { "title": … } }`). In `getCartComplementByProductIds`, `getCartSimilarByProductIds` and `getWishlistSimilarByProductIds` an explicit `langCode: undefined` in the body no longer overrides the default language — it answered `400 langCode must match …`.
+- **A block keeps its shape** (CMS-1110):
+  - `countElementsPerRow` and `quantity` are lifted from `customSettings` before validation — with `strictMode` the schema dropped `customSettings` first, and both fields disappeared;
+  - internal fields (`customSettings`, `productPageUrls`, `attributeSetIdentifier`) are removed in traffic-saving mode too, and the set marker under its real name — it was misspelt (`attributesSetIdentifier`) and stayed in every block;
+  - a failed product sub-request leaves an empty value of the declared type — `similarProducts: { items: [], total: 0 }`, `products: []` — instead of the error object or an array where a container is declared;
+  - `getBlocks` no longer passes its `offset` and `limit` to the products of each block: they page the list of blocks, and `offset: 5` emptied every block's products.
+- **`Blocks.getFrequentlyOrderedProducts` encodes the product id in the path** (CMS-1150): `'2954/../../x'` rewrote the path to `/blocks/freq_ordered/x/frequently-ordered`.
+- **JSDoc** (CMS-1117): `getChildPagesByParentUrl` takes the page's own `pageUrl`, not a nested path — `blog/blog1` answers `404`; the `about/our-team` example is gone. A no-op `delete` of a misspelt field is removed from `getBlocksByPageUrl` (CMS-1110).
+- **Discounts answer in the language of the call** (CMS-1130): `getAllDiscounts` and `getDiscountByMarker` unwrapped by the client's language; `getDiscountByMarker` no longer sends an empty `marker=` along. JSDoc of the class (copied from Events), `@handleName getAllDiscounts`, the marker example, `IBonusTransactionType`, the ISO date format of `getBonusHistory`.
+- **IntegrationCollections** (CMS-1163): row and collection ids are encoded in the path (`getICollectionById('1/rows')` returned rows, `rows/2/../3` row 3); `formData` of a created or updated row is an array even when the body was keyed by another language; JSDoc of `deleteICollectionRowByMarkerAndId` (a missing row answers IError `404 Row not found`, not `false`) and `updateICollectionRow` (`formData` replaces every field).
+- **AttributesSets JSDoc** (CMS-1166): `type` of a set is `{ id, type }` (`forProducts` …), `position` is the number of the set in the current answer, `sortBy: 'id'` sorts descending, the `listTitles` example matches the API.
+- **In Node.js a token is refreshed from any module** (CMS-1170). The fallback device id of `x-device-metadata` was generated per module, so a refresh-token issued through `AuthProvider` was refreshed from `Payments` (or any other module) with another fingerprint and answered `400 Provided token is incorrect` — the session broke on every access-token expiry in SSR and server scripts. The id lives on the client's shared state now (`state.nodeDeviceId`). Browsers were not affected.
+- **A request that got no answer is a failure** (CMS-1174). With `isShell` on, a dropped connection becomes `{ statusCode: 0, … }`, and `_fetchBoolean` took it for success: `subscribeByMarker`, `unsubscribeByMarker`, `subscribeToForm`, `unsubscribeFromForm`, `cancelSubscription`, `recoverSubscriptions`, `FileUploading.delete`, `trackUserActivity` returned `true`. `_isErrorResponse` recognizes the shell error now.
+- **Templates** (CMS-1187, CMS-1131): `getAllTemplates` returns the error (`400`, `401`, `422`) instead of an empty object; `getTemplateByType` encodes `type` — `'catalog_page#x'` cut the query and answered templates instead of `400`; `getTemplateByType` and `getTemplateByMarker` unwrap the answer by their `langCode`.
+- **Filters and Search answer in the language of the call** (CMS-1115, CMS-1116): `getFilterByMarker(marker, 'ru_RU')` returned `localizeInfos` keyed by locale; `globalSearch` unwrapped by the client's language. `globalSearch(query, [])` no longer sends `types=` — the API answered no groups.
+- **ProductStatuses send `langCode`** (CMS-1188): `getProductStatuses` and `getProductsByStatusMarker` took a language but did not pass it, and returned `localizeInfos: { "en_US": … }` for any other language.
+- **Numeric attributes of forms and attribute sets no longer get `value: null`** (CMS-1188): the normalization added the key to `integer`/`float`/`real` field descriptions, which carry no value.
+- **FileUploading** (CMS-1175): `delete` and `getFile` encode every query parameter — a `#` in a file name cut `type`, `entity` and `id` off, a `&id=` added parameters; `createFileFromUrl` throws on an error status instead of turning the storage's 404 page into a file; JSDoc of `getFile` (`template` is ignored by the endpoint), of `IFileSearchQueryLanguage.source` and `IFileSearchResponse.warnings`.
+- **Payments** (CMS-1171): ids are encoded in the path (`getSessionById('../accounts')` returned the accounts); `getSessionById` and `getAccountById` validate their answer; `PaymentAccountSchema.type` is the enum of the interface.
+- **Events JSDoc** (CMS-1103, CMS-1119, CMS-1129): `getAllEvents` requires a user; the default language is the client's, not `en_US`; the `ISubscriptions` example is the `{ total, items }` the API sends.
+- **Users** (CMS-1180):
+  - the FCM token and product ids are encoded in the path — `deleteFCMToken('../account')` resolved to `DELETE /users/me/account`, deleting the user, and `'..'` to `DELETE /users/me/`, archiving it;
+  - `getUser` returns `state` exactly as stored: it went through the attribute normalizer, which turned `{ en_US: 1, ru_RU: 2 }` into `1`, `{ type: 'integer', value: 'abc' }` into `value: null`, and threw a `TypeError` on `{ attributes: { x: 's' } }`; the normalizer also skips non-object entries now;
+  - `getUser` unwraps by its `langCode`; `updateUser` wraps `formData` under `body.langCode` when the body has one;
+  - `updateUser`, `archiveUser`, `deleteUser`, `addFCMToken`, `deleteFCMToken` answer `true` on an empty 2xx body instead of `{}`.
+- **Sign-in with a session open** (CMS-1179): `auth`, `signUp` and `oauth` go without the current session's `Authorization` and never trigger a token refresh — a wrong password answers `401`, which used to refresh the open session and send the same wrong password again (two failed attempts for one); `logout`/`logoutAll` clear the tokens only on success — a failed call wiped the tokens of a session still alive on the server; `oauth` stores the tokens it receives; a manual `refresh` stores tokens only when the answer carries them; `signUp` unwraps by its `langCode`.
+- **FormData** write methods encode the record id in the path (`updateFormsDataByid`, `updateFormsDataStatusByid`, `deleteFormsDataByid`).
+- **JSDoc**: `Subscriptions.getAllSubscriptions` needs no signed-in user (CMS-1103); `auth` takes string values only (CMS-1123); `oauth` returns `IAuthEntity`.
+- **JSDoc examples** (CMS-1205): product queries use an existing `signPrice` storage (`"my_order"`, a missing one fails the whole request with `404`), and the count filters a valid `conditionValue`; `getProductsCountByPageUrl` got its JSDoc back from `getProductsByVectorSearch`; `Payments.getAccounts`/`getAccountById` need no signed-in user, `Orders.getAllStatusesByStorageMarker` does; `@returns` of `getAccounts`, `getChildPagesByParentUrl` (404 for a missing parent) and `getProductBlockById` are arrays, `updateFormsDataByid` documents `body`; examples follow the API: `attributeValues` is a map by marker, block type `product_block` and products with `localizeInfos.title`, form data `formData` is an array and the extended fields come only with `isExtended`, `processingType: "script"`, unwrapped localization in attribute set schemas, list items with string `value` and `extended`, user `groups: [1]`, orders with `totalSum: "300"`, `previewImage: []`, `title`/`isGift`, preview proportions with `weight`/`default`, product statuses with `title` only, form markers `"reg"`, real general types, numeric `collectionId`.
+
+### What's Deleted
+
+- **`total` of a single form, discount, collection row, page and user** (`IFormsEntity`, `IDiscountsEntity`, `ICollectionRow`, `IPagesEntity`, `IUserEntity`, and their schemas): a service counter of the platform's list queries, always `"1"`. The platform stopped sending it (CMS-1088, CMS-1095).
+- **`IPaymentAccountTestSettings.signingSecretKey`**: the Stripe webhook signing secret is no longer returned to the app token (CMS-1091).
+
+### Tests
+
+- **`callercontracts.spec.ts`**: overlapping `Orders` calls keep their endpoints; a page URL, an id and a `langCode` stay inside their part of the URL; positional arguments win over `userQuery`; `getProductBlockById` and `createOrder` unwrap by the language of the call; a `401` without a refresh token is not followed by a refresh.
+- **`callercontracts.spec.ts`** (pages/blocks run): `Blocks.getBlockByMarker` and `Pages.getBlocksByPageUrl` unwrap by the language of the call; a lookup body with `langCode: undefined` keeps the default; a product block keeps `countElementsPerRow` and `quantity` under strict validation; the list offset does not page block products; a failed similar-products request leaves an empty container; traffic-saving mode removes internal fields; a product id stays inside its path segment.
+- **`callercontracts.spec.ts`** (collections/discounts/attribute-sets run): a collection id stays inside its path segment; rows by marker are paged; a created row returns `formData` as an array; `getDiscountByMarker` sends no empty marker and unwraps by its `langCode`; `getBonusHistory` pages; `multiselect` survives strict validation. `attributesets.spec.ts` snapshots now carry `multiselect`.
+- **`callercontracts.spec.ts`** (events/files/payments run): a file name stays inside its query parameter in `delete` and `getFile`; `createFileFromUrl` rejects an error page; a session id stays inside its path segment; a dropped connection is not a successful subscription. `payments.spec.ts` masks the payment-provider secrets before its snapshots — the snapshot used to keep the Stripe test-mode signing secret; `fileuploading.spec.ts` and `formsdata.spec.ts` point at an image that exists — the old one answered `404`, and the tests uploaded the error page as an image.
+- **`callercontracts.spec.ts`** (users/auth-provider/subscriptions run): a failed logout keeps the tokens; a sign-in with a wrong password is one request without the session; an FCM token stays inside its path segment; `archiveUser`/`updateUser` answer `true` on an empty body; `getUser` keeps `state` as stored and does not throw on it.
+- Platform fixes of 2026-10-29: `productstatuses.spec.ts` expects `validateMarker` to answer `true` for an existing marker (CMS-1069); `payments.spec.ts` reads the sessions of an order of the signed-in user (CMS-1092); `admins.spec.ts` no longer expects `identifier`; snapshots of users, admins, forms, discounts, payments and a collection marker follow the answers without `total`, logins and secrets.
+
+## v.1.0.176
+
+### What's Changed
+
+- **`FormDataType` describes `formData` as a read returns it** (CMS-1143). Checked on `getFormsDataByMarker` against every field type of a form:
+  - new branches `IBodyTypeEntity` (`entity`, `value: number[]`) and `IBodyTypeTimeInterval` (`timeInterval`, `value: string[][]` — `[start, end]` pairs); `IBodyTypeStringNumberFloat.type` takes `'integer'`;
+  - `list` and `radioButton` come back as the stored option values — `["1"]` and `"1"` — so `IBodyTypeRadioButtonList.value` is `IListOptionValue[] | string[] | string`;
+  - `text` and `textWithHeader` come back as a one-element array without `plainValue` and with `params.editorMode`: `value` takes an array too, `plainValue` and `isEditorDisabled` are optional, `editorMode` is added;
+  - the JSDoc no longer promises numbers and single-file objects on a read: numeric fields come back as strings (`3` → `"3"`), a single file as a one-element array.
+  Code that wrote these fields still compiles; code that read `value.plainValue` or `value[0].title` of a read now sees in the types what the API sends.
+
+### What's Fixed
+
+- **A marker is encoded before it goes into the request path** (CMS-1144). It was put into the URL as is in 59 places: `getFormsDataByMarker('..', 2)` resolved to `POST /api/content/form-data/` — the create endpoint — and `'test-form#'` cut the whole query off. Markers go through a new `AsyncModules._pathSegment` now: `?`, `#` and `/` are encoded, and a dot-only value reaches the API as an invalid marker (`400 marker must match …`) instead of another route. Valid markers are sent exactly as before. Page and product URLs (`getPageByUrl` and similar) are not changed.
+
+- **`FormData.postFormsData` unwraps the answer from the language it was sent in** (CMS-1125). A call with a `langCode` other than the client's returned `formData.formData` still keyed by the locale (`{ "ru_RU": [ … ] }`); the response is normalized with that `langCode` now, like the other methods of the module.
+
+- **JSDoc of the FormData module** (CMS-1145): `offset` from `0` and `limit` from `1`; `queryText` 1–512 characters, `vectorDistanceThreshold` from `0` and `maxHits` from `1` in vector search; `dateFrom` / `dateTo` take `YYYY-MM-DD HH:MM:SS` as well. The filter description said the API silently ignores an unknown field — it answers `400 property statuses should not exist`; a marker that matches nothing answers `200` with an empty list, not `404`.
+
+### Tests
+
+- **`callercontracts.spec.ts`**: `..` and `#` in a marker stay inside the path, a valid marker is sent unchanged; `postFormsData` in another language returns `formData` as an array; the field shapes of a `full_form` record compile as `FormDataType`.
+- **`formsdata.spec.ts`**: vector search no longer expects `ip` and `fingerprint` — the API does not send them.
+
 ## v.1.0.175
 
 ### What's Changed

package/dist/admins/adminsApi.js

@@ -115,15 +115,8 @@ class AdminsApi extends asyncModules_1.default {
             offset,
             limit,
         };
-        const savedUrl = this._url;
-        this._url = this._adminsUrl;
-        try {
-            const response = await this._fetchPost(`/vector/search?` + this._queryParamsToString(query), body);
-            return this._normalizeData(response, langCode);
-        }
-        finally {
-            this._url = savedUrl;
-        }
+        const response = await this._withBaseUrl(this._adminsUrl)._fetchPost(`/vector/search?` + this._queryParamsToString(query), body);
+        return this._normalizeData(response, langCode);
     }
 }
 exports.default = AdminsApi;

package/dist/admins/adminsInterfaces.d.ts

@@ -94,10 +94,10 @@ interface IPosition {
  * @interface IAdminEntity
  * @property {number} id - Object ID. Example: 1764.
  * @property {number | null} attributeSetId - ID of the attribute set in use. Example: 120.
- * @property {string} identifier - Text identifier (marker) of the object. Example: "admin1".
+ * @property {string} [identifier] - Not returned by the Content API: it was the admin's sign-in login, and the platform no longer sends it. Kept optional for compatibility.
  * @property {string | null} attributeSetIdentifier - Marker of the attribute set. Example: "admins".
  * @property {number | null} position - Position used for sorting. Example: 1.
- * @property {boolean} isSync - Whether the page is indexed. Example: true.
+ * @property {boolean} isSync - Whether the admin has attribute data in the requested language (`false` with empty `attributeValues` otherwise). Example: true.
  * @property {IAttributeValues} attributeValues - Attribute values keyed by attribute marker.
  * @example
     [
@@ -108,19 +108,19 @@ interface IPosition {
         }
       }
     ]
- * @property {IFormConfig[]} [moduleFormConfigs] - Form configurations of the module associated with the admin.
+ * @property {IFormConfig[]} [formModuleConfigs] - Form configurations of the module associated with the admin (the API key is `formModuleConfigs`). Example: [].
  * @property {number} [distance] - Cosine distance to the query. Returned only by the semantic (vector) search endpoint when `debug: true` is passed in the search body. Example: 0.12.
  * @description This interface captures the essential details and additional attributes of an admin entity.
  */
 interface IAdminEntity {
     id: number;
     attributeSetId: number | null;
-    identifier: string;
+    identifier?: string;
     attributeSetIdentifier: string | null;
     position: number | null;
     isSync: boolean;
     attributeValues: IAttributeValues;
-    moduleFormConfigs?: IFormConfig[];
+    formModuleConfigs?: IFormConfig[];
     distance?: number;
 }
 /**

package/dist/admins/adminsSchemas.d.ts

@@ -10,12 +10,12 @@ import { z } from 'zod';
 export declare const AdminEntitySchema: z.ZodObject<{
     id: z.ZodNumber;
     attributeSetId: z.ZodNullable<z.ZodNumber>;
-    identifier: z.ZodString;
+    identifier: z.ZodOptional<z.ZodString>;
     attributeSetIdentifier: z.ZodNullable<z.ZodString>;
     position: z.ZodNullable<z.ZodNumber>;
     isSync: z.ZodBoolean;
     attributeValues: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    moduleFormConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
+    formModuleConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
     distance: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /**
@@ -24,11 +24,11 @@ export declare const AdminEntitySchema: z.ZodObject<{
 export declare const AdminsResponseSchema: z.ZodArray<z.ZodObject<{
     id: z.ZodNumber;
     attributeSetId: z.ZodNullable<z.ZodNumber>;
-    identifier: z.ZodString;
+    identifier: z.ZodOptional<z.ZodString>;
     attributeSetIdentifier: z.ZodNullable<z.ZodString>;
     position: z.ZodNullable<z.ZodNumber>;
     isSync: z.ZodBoolean;
     attributeValues: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    moduleFormConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
+    formModuleConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
     distance: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>>;

package/dist/admins/adminsSchemas.js

@@ -14,12 +14,12 @@ const validation_1 = require("../base/validation");
 exports.AdminEntitySchema = zod_1.z.object({
     id: zod_1.z.number(),
     attributeSetId: zod_1.z.number().nullable(),
-    identifier: zod_1.z.string(),
+    identifier: zod_1.z.string().optional(),
     attributeSetIdentifier: zod_1.z.string().nullable(),
     position: zod_1.z.number().nullable(),
     isSync: zod_1.z.boolean(),
     attributeValues: validation_1.AttributeValuesSchema,
-    moduleFormConfigs: zod_1.z.array(zod_1.z.any()).optional(),
+    formModuleConfigs: zod_1.z.array(zod_1.z.any()).optional(),
     distance: zod_1.z.number().optional(),
 });
 /**

package/dist/attribute-sets/attributeSetsApi.d.ts

@@ -27,7 +27,7 @@ export default class AttributesSetsApi extends AsyncModules implements IAttribut
      * @param {number} [offset] - Number of records to skip. Default: 0.
      * @param {number} [limit] - Maximum number of records to return. Default: 30.
      * @param {number} [typeId] - ID of the attribute set type to filter by. Default: null.
-     * @param {string} [sortBy] - Field to sort by: `id` or `position`. Default: "id".
+     * @param {string} [sortBy] - Field to sort by: `id` (descending) or `position`. Default: "id".
      * @returns {Promise<IAttributesSetsResponse | IError>} Returns object with array of IAttributeSetsEntity and total items count.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/attribute-sets/getAttributes getAttributes} documentation.

package/dist/attribute-sets/attributeSetsApi.js

@@ -65,7 +65,7 @@ class AttributesSetsApi extends asyncModules_1.default {
      * @param {number} [offset] - Number of records to skip. Default: 0.
      * @param {number} [limit] - Maximum number of records to return. Default: 30.
      * @param {number} [typeId] - ID of the attribute set type to filter by. Default: null.
-     * @param {string} [sortBy] - Field to sort by: `id` or `position`. Default: "id".
+     * @param {string} [sortBy] - Field to sort by: `id` (descending) or `position`. Default: "id".
      * @returns {Promise<IAttributesSetsResponse | IError>} Returns object with array of IAttributeSetsEntity and total items count.
      * @throws {IError} When isShell=false and an error occurs during the fetch
      * @see {@link https://js-sdk.oneentry.cloud/docs/attribute-sets/getAttributes getAttributes} documentation.
@@ -96,7 +96,7 @@ class AttributesSetsApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/attribute-sets/getAttributesByMarker getAttributesByMarker} documentation.
      */
     async getAttributesByMarker(marker, langCode = this.state.lang) {
-        const result = await this._fetchGet(`/${marker}/attributes?langCode=${langCode}`);
+        const result = await this._fetchGet(`/${this._pathSegment(marker)}/attributes?langCode=${encodeURIComponent(langCode)}`);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('AttributesArrayResponseSchema'));
         return this._normalizeData(validated, langCode);
@@ -112,7 +112,7 @@ class AttributesSetsApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/attribute-sets/getSingleAttributeByMarkerSet getSingleAttributeByMarkerSet} documentation.
      */
     async getSingleAttributeByMarkerSet(setMarker, attributeMarker, langCode = this.state.lang) {
-        const result = await this._fetchGet(`/${setMarker}/attributes/${attributeMarker}?langCode=${langCode}`);
+        const result = await this._fetchGet(`/${this._pathSegment(setMarker)}/attributes/${this._pathSegment(attributeMarker)}?langCode=${encodeURIComponent(langCode)}`);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('AttributeEntitySchema'));
         return this._normalizeData(validated, langCode);
@@ -127,7 +127,7 @@ class AttributesSetsApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/attribute-sets/getAttributeSetByMarker getAttributeSetByMarker} documentation.
      */
     async getAttributeSetByMarker(marker, langCode = this.state.lang) {
-        const result = await this._fetchGet(`/marker/${marker}?langCode=${langCode}`);
+        const result = await this._fetchGet(`/marker/${this._pathSegment(marker)}?langCode=${encodeURIComponent(langCode)}`);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('AttributeSetEntitySchema'));
         return this._normalizeData(validated, langCode);

package/dist/attribute-sets/attributeSetsInterfaces.d.ts

@@ -5,6 +5,27 @@ import type { IAttributeLocalizeInfo, IError, ITimeIntervalSchedule } from '../b
  * @description This interface defines methods for retrieving attributes based on markers and language codes.
  */
 interface IAttributesSets {
+    /**
+     * Getting all attribute sets objects.
+     * @handleName getAttributes
+     * @param {string} [langCode] - Language code. Default: "en_US".
+     * @param {number} [offset] - Number of records to skip. Default: 0.
+     * @param {number} [limit] - Maximum number of records to return. Default: 30.
+     * @param {number} [typeId] - ID of the attribute set type to filter by. Default: null.
+     * @param {string} [sortBy] - Field to sort by: `id` (descending) or `position`. Default: "id".
+     * @returns {IAttributesSetsResponse} Object with the array of IAttributeSetsEntity and the total count.
+     * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
+     */
+    getAttributes(langCode?: string, offset?: number, limit?: number, typeId?: any, sortBy?: string): Promise<IAttributesSetsResponse | IError>;
+    /**
+     * Getting one attribute set object by its marker.
+     * @handleName getAttributeSetByMarker
+     * @param {string} marker - Marker of the attribute set. Example: "full_form".
+     * @param {string} [langCode] - Language code. Default: "en_US".
+     * @returns {IAttributeSetsEntity} The attribute set with its schema.
+     * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
+     */
+    getAttributeSetByMarker(marker: string, langCode?: string): Promise<IAttributeSetsEntity | IError>;
     /**
      * Fetches attributes by a specific marker.
      * @handleName getAttributesByMarker
@@ -91,17 +112,15 @@ type AttributeType = 'string' | 'text' | 'textWithHeader' | 'integer' | 'real' |
     [
       {
         "title": "red",
-        "value": 1,
+        "value": "1",
         "position": 1,
-        "extendedValue": null,
-        "extendedValueType": null
+        "extended": { "type": null, "value": null }
       },
       {
         "title": "yellow",
-        "value": 2,
+        "value": "2",
         "position": 2,
-        "extendedValue": null,
-        "extendedValueType": null
+        "extended": { "type": null, "value": null }
       }
     ]
  * @property {IAttributeValidators} validators - Validators configured for the attribute; empty object when none are set.
@@ -119,7 +138,12 @@ type AttributeType = 'string' | 'text' | 'textWithHeader' | 'integer' | 'real' |
    {
      "title": "My attribute"
    }
- * @property {Record<string, IAttributesSetsEntity>} additionalFields - Nested sub-attributes keyed by marker; an empty object when there are none.
+ * @property {Record<string, IAttributeAdditionalField>} additionalFields - Additional fields of the attribute keyed by marker: a type and a value each, not full attributes. An empty object when there are none.
+ * @example
+   {
+     "additional_field": { "type": "string", "value": "Additional field data" }
+   }
+ * @property {boolean} [multiselect] - For `list` attributes — whether several options from `listTitles` may be selected. Example: false.
  * @description This interface defines the structure of an attribute set entity, including its type, marker, position, validators, localization information, list titles, additional fields, and settings.
  */
 interface IAttributesSetsEntity {
@@ -131,7 +155,18 @@ interface IAttributesSetsEntity {
     listTitles: IListTitle[];
     validators: IAttributeValidators;
     localizeInfos: IAttributeLocalizeInfo;
-    additionalFields: Record<string, IAttributesSetsEntity>;
+    additionalFields: Record<string, IAttributeAdditionalField>;
+    multiselect?: boolean;
+}
+/**
+ * @interface IAttributeAdditionalField
+ * @property {string} type - Type of the additional field. Example: "string".
+ * @property {unknown} value - Value of the additional field. Example: "Additional field data".
+ * @description An additional field of an attribute, as `getAttributesByMarker` returns it.
+ */
+interface IAttributeAdditionalField {
+    type: string;
+    value: unknown;
 }
 /**
  * @interface IAttributeSchemaItem
@@ -149,7 +184,7 @@ interface IAttributesSetsEntity {
  * @property {boolean} [multiselect] - For `list` fields — whether several options from `listTitles` may be selected. Optional. Example: false.
  * @property {string} [moduleIdentifier] - For `entity` fields — identifier of the module the linked entities are taken from. Optional. Example: "catalog".
  * @property {number | null} [parentId] - Identifier of the parent field, `null` for top-level. Optional, seen on `groupOfImages` fields.
- * @property {Record<string, IAttributeSchemaItem>} [additionalFields] - Nested sub-fields keyed by marker. Optional.
+ * @property {Record<string, IAttributeAdditionalField>} [additionalFields] - Additional fields keyed by marker: a type and a value each. Optional. Example: `{ "additional_field": { "type": "string", "value": "Additional field data" } }`.
  * @property {IAttributeValidators} [validators] - Validation rules for the field. Optional.
  * @property {boolean | string} [splitUnit] - Splitting unit configuration; `false` when disabled, otherwise the unit name (e.g. "percent"). Optional, used by numeric fields.
  * @property {number[] | boolean} [splitParts] - For split-price fields — ids of the schema fields the price is split into (e.g. [2, 3]); `false` when the field does not split. Optional.
@@ -159,6 +194,14 @@ interface IAttributesSetsEntity {
  * @property {boolean} [receiveValues] - For `timeInterval` fields — whether the field receives precomputed values. Optional.
  * @property {ITimeIntervalSchedule[]} [intervals] - For `timeInterval` fields — top-level schedule definition (separate from `localizeInfos.intervals`). Optional.
  * @property {unknown} [value] - Current value of the field: `null` on numeric fields without a value, an array of schedule groups on `timeInterval` fields. Optional.
+ * @property {boolean} [isLogin] - Whether the field is the login of a sign-up form. Optional.
+ * @property {boolean} [isSignUp] - Whether the field is filled at sign-up. Optional.
+ * @property {boolean} [isPassword] - Whether the field is the password of a sign-up form. Optional.
+ * @property {boolean} [isNotificationEmail] - Whether the field is the e-mail used for notifications. Optional.
+ * @property {boolean} [isNotificationPhoneSMS] - Whether the field is the phone used for SMS notifications. Optional.
+ * @property {boolean} [isNotificationPhonePush] - Whether the field is the phone used for push notifications. Optional.
+ * @property {boolean} [isProductPreview] - Whether the field is the product preview image. Optional.
+ * @property {number | null} [previewTemplateId] - ID of the preview template of an image field. Optional.
  * @description Definition of a single field inside an attribute set's schema.
  */
 interface IAttributeSchemaItem {
@@ -176,7 +219,7 @@ interface IAttributeSchemaItem {
     listType?: string;
     moduleIdentifier?: string;
     parentId?: number | null;
-    additionalFields?: Record<string, IAttributeSchemaItem>;
+    additionalFields?: Record<string, IAttributeAdditionalField>;
     validators?: IAttributeValidators;
     splitUnit?: boolean | string;
     splitParts?: number[] | boolean;
@@ -186,6 +229,14 @@ interface IAttributeSchemaItem {
     receiveValues?: boolean;
     intervals?: ITimeIntervalSchedule[];
     value?: unknown;
+    isLogin?: boolean;
+    isSignUp?: boolean;
+    isPassword?: boolean;
+    isNotificationEmail?: boolean;
+    isNotificationPhoneSMS?: boolean;
+    isNotificationPhonePush?: boolean;
+    isProductPreview?: boolean;
+    previewTemplateId?: number | null;
 }
 /**
  * @interface IAttributeValidators
@@ -333,13 +384,13 @@ interface IAttributeValidators {
        "original": true,
        "identifier": "string",
        "localizeInfos": {
-         "en_US": { "title": "String" }
+         "title": "String"
        }
      }
    }
  * @property {boolean} isVisible - Whether the attribute set is visible. Example: true.
- * @property {string} type - Type of the attribute set. Example: "product", "user", "etc".
- * @property {number} position - Position of the attribute set, used for sorting. Example: 1.
+ * @property {IAttributeSetTypeRef} type - Type of the attribute set: an object with the type id and name. Example: `{ "id": 1, "type": "forProducts" }`.
+ * @property {number} position - Number of the set in the current answer, not a property of the set: it changes with `sortBy` (set 38 is `1` by `id` and `21` by `position`). Example: 1.
  * @description This interface defines the structure of an attribute set entity.
  */
 interface IAttributeSetsEntity {
@@ -386,4 +437,4 @@ interface IAttributesSetsResponse {
     total: number;
     items: IAttributeSetsEntity[];
 }
-export type { AttributeType, IAttributeSchemaItem, IAttributeSetsEntity, IAttributeSetTypeRef, IAttributesSets, IAttributesSetsEntity, IAttributesSetsResponse, IAttributeValidators, IListTitle, IListTitleEntityValue, IListTitleExtended, };
+export type { AttributeType, IAttributeAdditionalField, IAttributeSchemaItem, IAttributeSetsEntity, IAttributeSetTypeRef, IAttributesSets, IAttributesSetsEntity, IAttributesSetsResponse, IAttributeValidators, IListTitle, IListTitleEntityValue, IListTitleExtended, };

package/dist/attribute-sets/attributeSetsSchemas.d.ts

@@ -24,10 +24,11 @@ export declare const AttributeEntitySchema: z.ZodObject<{
     initialValue: z.ZodAny;
     marker: z.ZodString;
     position: z.ZodNumber;
-    listTitles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
-    validators: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>>;
+    listTitles: z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    validators: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
     localizeInfos: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
-    additionalFields: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>>;
+    additionalFields: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
+    multiselect: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * Attribute set entity schema (attribute set object)
@@ -77,8 +78,9 @@ export declare const AttributesArrayResponseSchema: z.ZodArray<z.ZodObject<{
     initialValue: z.ZodAny;
     marker: z.ZodString;
     position: z.ZodNumber;
-    listTitles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
-    validators: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>>;
+    listTitles: z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    validators: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
     localizeInfos: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
-    additionalFields: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>>;
+    additionalFields: z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodAny>, z.ZodArray<z.ZodAny>]>;
+    multiselect: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>>;

package/dist/attribute-sets/attributeSetsSchemas.js

@@ -27,16 +27,13 @@ exports.AttributeEntitySchema = zod_1.z.object({
     initialValue: zod_1.z.any(),
     marker: zod_1.z.string(),
     position: zod_1.z.number(),
-    listTitles: zod_1.z
-        .union([zod_1.z.array(zod_1.z.any()), zod_1.z.record(zod_1.z.string(), zod_1.z.any())])
-        .optional(),
-    validators: zod_1.z
-        .union([zod_1.z.record(zod_1.z.string(), zod_1.z.any()), zod_1.z.array(zod_1.z.any())])
-        .optional(),
+    // Required as in IAttributesSetsEntity: the API sends them on every attribute
+    listTitles: zod_1.z.union([zod_1.z.array(zod_1.z.any()), zod_1.z.record(zod_1.z.string(), zod_1.z.any())]),
+    validators: zod_1.z.union([zod_1.z.record(zod_1.z.string(), zod_1.z.any()), zod_1.z.array(zod_1.z.any())]),
     localizeInfos: zod_1.z.union([zod_1.z.record(zod_1.z.string(), zod_1.z.any()), zod_1.z.array(zod_1.z.any())]),
-    additionalFields: zod_1.z
-        .union([zod_1.z.record(zod_1.z.string(), zod_1.z.any()), zod_1.z.array(zod_1.z.any())])
-        .optional(),
+    additionalFields: zod_1.z.union([zod_1.z.record(zod_1.z.string(), zod_1.z.any()), zod_1.z.array(zod_1.z.any())]),
+    // The API sends it on list attributes; without it here validation dropped the field
+    multiselect: zod_1.z.boolean().optional(),
 });
 /**
  * Attribute set entity schema (attribute set object)