oneentry 1.0.176 → 1.0.177

package/dist/events/eventsInterfaces.d.ts

@@ -20,7 +20,7 @@ interface IEvents {
      * @handleName subscribeByMarker
      * @param {string} marker - The marker identifying the event. Example: "product_price_change".
      * @param {number} productId - The ID of the product to subscribe to. Example: 12345.
-     * @param {string} [langCode] - Optional language code for localization. Default: "en_US".
+     * @param {string} [langCode] - Optional language code for localization. Default: the client's language.
      * @returns {Promise<boolean | IError>} A promise that resolves to any type or an error.
      * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
      * @description This method subscribes to an event on a product by its marker.
@@ -31,7 +31,7 @@ interface IEvents {
      * @handleName unsubscribeByMarker
      * @param {string} marker - The marker identifying the event. Example: "product_price_change".
      * @param {number} productId - ID of the product to unsubscribe from. Example: 12345.
-     * @param {string} [langCode] - Optional language code for localization. Default: "en_US".
+     * @param {string} [langCode] - Optional language code for localization. Default: the client's language.
      * @returns {Promise<boolean | IError>} A promise that resolves to any type or an error.
      * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
      * @description This method unsubscribes from an event on a product by its marker.
@@ -42,7 +42,7 @@ interface IEvents {
      * @handleName getAllEvents
      * @returns {Promise<IContentApiEvent[] | IError>} A promise that resolves to an array of events or an error.
      * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
-     * @description This method returns all available events.
+     * @description This method returns all available events. This method requires user authorization — without it the API answers `401 Unauthorized`.
      */
     getAllEvents(): Promise<IContentApiEvent[] | IError>;
     /**
@@ -85,16 +85,12 @@ interface IEvents {
  * @property {number} total - Total number of found records. Example: 100.
  * @property {ISubscriptionItem[]} items - Subscriptions, each with an event marker and a product ID.
  * @example
- [
-   {
-     eventMarker: 'product_price_change',
-     productId: 12345
-   },
-   {
-     eventMarker: 'product_stock_update',
-     productId: 67890
-   }
- ]
+ {
+   "total": 1,
+   "items": [
+     { "eventMarker": "lessPrice", "productId": 2954 }
+   ]
+ }
  * @property { string } items.eventMarker - Event marker.
  * @property { number } items.productId - Product ID.
  * @description Represents a response from the events API containing a total count and an array of subscription items.
@@ -173,4 +169,4 @@ interface ISubscribeFormEvent {
     formDataId: number;
     status?: string;
 }
-export type { IContentApiEvent, IEvents, IFormSubscriptionsResponse, IListFormSubscription, ISubscribeBody, ISubscribeFormEvent, ISubscriptions, };
+export type { IContentApiEvent, IEvents, IFormSubscriptionsResponse, IListFormSubscription, ISubscribeBody, ISubscribeFormEvent, ISubscriptionItem, ISubscriptions, };

package/dist/file-uploading/fileUploadingApi.d.ts

@@ -99,6 +99,7 @@ export default class FileUploadingApi extends AsyncModules implements IFileUploa
      * @param {string} filename - The name to give the created file.
      * @param {string} [mimeType] - Optional MIME type for the file.
      * @returns {Promise<File>} A promise that resolves to a File object.
+     * @throws {Error} When the URL answers with an error status — the body of the error page is not turned into a file.
      */
     createFileFromUrl(url: string, filename: string, mimeType?: string): Promise<File>;
     /**
@@ -108,10 +109,9 @@ export default class FileUploadingApi extends AsyncModules implements IFileUploa
      * @param {string} type - Storage type; determines the folder the file is stored in, for example `"page"`. Example: "page".
      * @param {string} entity - Name of the entity the file belongs to; sets the folder name in the storage. Example: "editor".
      * @param {string} filename - File name. Example: "file.png".
-     * @param {string} [template] - Preview template: its numeric ID or its marker, for example `"preview"`. Without it, no preview is generated. Example: "preview_template".
-     * @returns {Promise<Response | IError>} Returns a promise that resolves to a Response object containing the file data or an error object if there was an issue.
-     * @throws {IError} When isShell=false and an error occurs during the fetch
+     * @param {string} [template] - Kept for compatibility: `GET /files` ignores it — the answer is the original file with any value, an unknown template included (CMS-1101, CMS-1128). Previews are made on `upload`.
+     * @returns {Promise<Response>} Resolves to the raw `Response` of the request — also on an error: check `response.ok`. A missing file answers `404` with a JSON body but a `content-type` taken from the requested file name (`image/png` …).
      * @see {@link https://js-sdk.oneentry.cloud/docs/file-uploading/getFile getFile} documentation.
      */
-    getFile(id: number, type: string, entity: string, filename: string, template?: string): Promise<Response | IError>;
+    getFile(id: number, type: string, entity: string, filename: string, template?: string): Promise<Response>;
 }

package/dist/file-uploading/fileUploadingApi.js

@@ -121,7 +121,10 @@ class FileUploadingApi extends asyncModules_1.default {
         const query = { ...this._defaultQuery, ...fileQuery };
         // The endpoint answers 200 with an empty body, which _parseJson reads as `{}`;
         // _fetchBoolean turns that into the declared `true` (CMS-1072)
-        return this._fetchBoolean(() => this._fetchDelete(`?filename=${filename}&` + this._queryParamsToString(query)));
+        return this._fetchBoolean(() => this._fetchDelete(
+        // The name is encoded like the other parameters: `#` cut the query and dropped
+        // type/entity/id, `&id=` added parameters of its own
+        `?` + this._queryParamsToString({ filename, ...query })));
     }
     /**
      * Public search across the content of files attached to records.
@@ -171,10 +174,15 @@ class FileUploadingApi extends asyncModules_1.default {
      * @param {string} filename - The name to give the created file.
      * @param {string} [mimeType] - Optional MIME type for the file.
      * @returns {Promise<File>} A promise that resolves to a File object.
+     * @throws {Error} When the URL answers with an error status — the body of the error page is not turned into a file.
      */
     async createFileFromUrl(url, filename, mimeType) {
         // eslint-disable-next-line no-undef
         const response = await fetch(url);
+        // A 404 page of the storage used to become the "file" and was then uploaded as is
+        if (!response.ok) {
+            throw new Error(`OneEntry SDK: createFileFromUrl got ${response.status} from ${url}`);
+        }
         const blob = await response.blob();
         const file = new File([blob], filename, { type: mimeType || blob.type });
         return file;
@@ -186,14 +194,14 @@ class FileUploadingApi extends asyncModules_1.default {
      * @param {string} type - Storage type; determines the folder the file is stored in, for example `"page"`. Example: "page".
      * @param {string} entity - Name of the entity the file belongs to; sets the folder name in the storage. Example: "editor".
      * @param {string} filename - File name. Example: "file.png".
-     * @param {string} [template] - Preview template: its numeric ID or its marker, for example `"preview"`. Without it, no preview is generated. Example: "preview_template".
-     * @returns {Promise<Response | IError>} Returns a promise that resolves to a Response object containing the file data or an error object if there was an issue.
-     * @throws {IError} When isShell=false and an error occurs during the fetch
+     * @param {string} [template] - Kept for compatibility: `GET /files` ignores it — the answer is the original file with any value, an unknown template included (CMS-1101, CMS-1128). Previews are made on `upload`.
+     * @returns {Promise<Response>} Resolves to the raw `Response` of the request — also on an error: check `response.ok`. A missing file answers `404` with a JSON body but a `content-type` taken from the requested file name (`image/png` …).
      * @see {@link https://js-sdk.oneentry.cloud/docs/file-uploading/getFile getFile} documentation.
      */
     async getFile(id, type, entity, filename, template) {
         // eslint-disable-next-line no-undef
-        const response = await fetch(this._getFullPath(`?id=${id}&type=${type}&entity=${entity}${`&filename=${filename}`}${template ? `&template=${template}` : ''}`), {
+        const response = await fetch(this._getFullPath('?' +
+            this._queryParamsToString({ id, type, entity, filename, template })), {
             method: 'GET',
             headers: {
                 'Content-Type': 'application/json',

package/dist/file-uploading/fileUploadingInterfaces.d.ts

@@ -66,11 +66,10 @@ interface IFileUploading {
      * @param {string} type - Storage type; determines the folder the file is stored in, for example `"page"`. Example: "page".
      * @param {string} entity - Name of the entity the file belongs to; sets the folder name in the storage. Example: "editor".
      * @param {string} filename - File name. Example: "file.png".
-     * @param {string} [template] - Preview template: its numeric ID or its marker, for example `"preview"`. Without it, no preview is generated. Example: "1".
-     * @returns {Response | IError} Returns a promise that resolves to a Response object containing the file data or an error object if there was an issue.
-     * @throws {IError} - If there is an error during the fetch operation, it will return an error object.
+     * @param {string} [template] - Kept for compatibility: `GET /files` ignores it — the answer is the original file with any value, an unknown template included (CMS-1101, CMS-1128). Previews are made on `upload`.
+     * @returns {Response} The raw `Response` of the request — also on an error: check `response.ok`. A missing file answers `404` with a JSON body but a `content-type` taken from the file name. No IError is returned and nothing is thrown on an HTTP error.
      */
-    getFile(id: number, type: string, entity: string, filename: string, template?: string): Promise<Response | IError>;
+    getFile(id: number, type: string, entity: string, filename: string, template?: string): Promise<Response>;
     /**
      * Public search across the content of files attached to records.
      * @handleName searchFileContent
@@ -186,7 +185,7 @@ interface IFileSearchItem {
  * The `IFileSearchQueryLanguage` interface describes how the query language was resolved.
  * @interface IFileSearchQueryLanguage
  * @property {string[]} resolved - Languages the query was actually run in. Example: ["english"].
- * @property {string} source - How they were chosen: "explicit" when taken from `langCode`, otherwise detected. Example: "explicit".
+ * @property {string} source - How they were chosen: `"explicit"` when taken from `langCode`; detected otherwise (seen: `"script"`). Detection runs only with `langCode: ""` — by default the client's language is sent. Example: "explicit".
  * @property {string[]} candidates - Languages that were considered. Example: ["english"].
  * @description How the query language was resolved for the search.
  */
@@ -202,7 +201,7 @@ interface IFileSearchQueryLanguage {
  * @property {number} offset - Number of records to skip. Example: 0.
  * @property {number} limit - Maximum number of records to return. Example: 10.
  * @property {IFileSearchQueryLanguage} queryLanguage - How the query language was resolved.
- * @property {string[]} warnings - Warnings about the search, empty when there are none.
+ * @property {string[]} warnings - Warning codes, empty when there are none. Seen: `processing_disabled` (content indexing is off — `items` is always empty), `query_language_capped`, `query_too_common`.
  * @property {IFileSearchItem[]} items - Files that match the query.
  * @description The result of a file content search.
  */

package/dist/filters/filtersApi.js

@@ -67,9 +67,9 @@ class FiltersApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/filters/getFilterByMarker getFilterByMarker} documentation.
      */
     async getFilterByMarker(marker, langCode = this.state.lang) {
-        const data = await this._fetchGet(`/marker/${this._pathSegment(marker)}?langCode=${langCode}`);
+        const data = await this._fetchGet(`/marker/${this._pathSegment(marker)}?langCode=${encodeURIComponent(langCode)}`);
         const validated = await this._validateResponse(data, schema('ContentFilterSchema'));
-        return this._normalizeData(validated);
+        return this._normalizeData(validated, langCode);
     }
 }
 exports.default = FiltersApi;

package/dist/forms/formsApi.js

@@ -69,7 +69,7 @@ class FormsApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms/getAllForms getAllForms} documentation.
      */
     async getAllForms(langCode = this.state.lang, offset = 0, limit = 30) {
-        const result = await this._fetchGet(`?langCode=${langCode}&offset=${offset}&limit=${limit}`);
+        const result = await this._fetchGet(`?langCode=${encodeURIComponent(langCode)}&offset=${encodeURIComponent(String(offset))}&limit=${encodeURIComponent(String(limit))}`);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('FormsResponseSchema'));
         return this._normalizeData(validated, langCode);
@@ -84,7 +84,7 @@ class FormsApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms/getFormByMarker getFormByMarker} documentation.
      */
     async getFormByMarker(marker, langCode = this.state.lang) {
-        const result = await this._fetchGet(`/marker/${this._pathSegment(marker)}?langCode=${langCode}`);
+        const result = await this._fetchGet(`/marker/${this._pathSegment(marker)}?langCode=${encodeURIComponent(langCode)}`);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('FormEntitySchema'));
         return this._normalizeData(validated, langCode);

package/dist/forms/formsInterfaces.d.ts

@@ -69,10 +69,9 @@ interface IFromPages {
  * @property {number} version - Version number of the object; changes with each update. Example: 1.
  * @property {number} position - Position of the object, used for sorting. Example: 1.
  * @property {string} identifier - Text identifier (marker) of the object. Example: "form_contact_us".
- * @property {string} processingType - How form submissions are processed, for example `"email"` or `"url"`. Example: "async".
+ * @property {string} processingType - How form submissions are processed: the processing type chosen in the form settings. Example: "script".
  * @property {number | null} templateId - ID of the template used by the form, or `null` when the form has no template. Example: 6789.
  * @property {IFormAttribute[]} attributes - Form fields with their localization, validators and form-specific flags, sorted by `position`. The API returns an empty object for forms with no attributes — the SDK normalizes it to an empty array.
- * @property {number | string} [total] - Total count of related entries. Example: "1".
  * @property {IFormConfig[]} [moduleFormConfigs] - Form configurations of the module associated with the form.
  * @description This interface defines the structure of a form entity, including its identifiers, attributes, and processing data.
  */
@@ -87,7 +86,6 @@ interface IFormsEntity {
     processingType: string;
     templateId: number | null;
     attributes: IFormAttribute[];
-    total?: number | string;
     moduleFormConfigs?: IFormConfig[];
 }
 /**

package/dist/forms/formsSchemas.d.ts

@@ -13,8 +13,7 @@ export declare const FormEntitySchema: z.ZodObject<{
     type: z.ZodNullable<z.ZodString>;
     attributeSetId: z.ZodNullable<z.ZodNumber>;
     templateId: z.ZodNullable<z.ZodNumber>;
-    total: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
-    attributes: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
+    attributes: z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
     moduleFormConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
 }, z.core.$strip>;
 /**
@@ -32,8 +31,7 @@ export declare const FormsResponseSchema: z.ZodObject<{
         type: z.ZodNullable<z.ZodString>;
         attributeSetId: z.ZodNullable<z.ZodNumber>;
         templateId: z.ZodNullable<z.ZodNumber>;
-        total: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
-        attributes: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
+        attributes: z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
         moduleFormConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -50,7 +48,6 @@ export declare const SingleFormSchema: z.ZodObject<{
     type: z.ZodNullable<z.ZodString>;
     attributeSetId: z.ZodNullable<z.ZodNumber>;
     templateId: z.ZodNullable<z.ZodNumber>;
-    total: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
-    attributes: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
+    attributes: z.ZodUnion<readonly [z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
     moduleFormConfigs: z.ZodOptional<z.ZodArray<z.ZodAny>>;
 }, z.core.$strip>;

package/dist/forms/formsSchemas.js

@@ -16,10 +16,8 @@ exports.FormEntitySchema = zod_1.z.object({
     type: zod_1.z.string().nullable(),
     attributeSetId: zod_1.z.number().nullable(),
     templateId: zod_1.z.number().nullable(),
-    total: zod_1.z.union([zod_1.z.number(), zod_1.z.string()]).optional(),
-    attributes: zod_1.z
-        .union([zod_1.z.array(zod_1.z.any()), zod_1.z.record(zod_1.z.string(), zod_1.z.any())])
-        .optional(),
+    // Required as in IFormsEntity: a form without fields comes as `{}`
+    attributes: zod_1.z.union([zod_1.z.array(zod_1.z.any()), zod_1.z.record(zod_1.z.string(), zod_1.z.any())]),
     moduleFormConfigs: zod_1.z.array(zod_1.z.any()).optional(),
 });
 /**

package/dist/forms-data/formsDataApi.d.ts

@@ -140,6 +140,22 @@ export default class FormsDataApi extends AsyncModules implements IFormsData {
      * Update one object of form data by id. Requires user authentication.
      * @handleName updateFormsDataByid
      * @param {number} id - Form data ID. Example: 1.
+     * @param {object} [body] - Form data to save: the same fields as in `postFormsData` (`formIdentifier`, `formModuleConfigId`, `moduleEntityIdentifier`, `replayTo`, `status`, `formData`). Default: `{}`.
+     * @example
+        {
+          "formIdentifier": "test-form",
+          "formModuleConfigId": 2,
+          "moduleEntityIdentifier": "blog",
+          "replayTo": null,
+          "status": "sent",
+          "formData": [
+            {
+              "marker": "name",
+              "type": "string",
+              "value": "Test"
+            }
+          ]
+        }
      * @returns {Promise<IUpdateFormsData | IError>} Returns an object containing the updated form data or an error object if there was an issue.
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms-data/updateFormsDataByid updateFormsDataByid} documentation.
      */

package/dist/forms-data/formsDataApi.js

@@ -166,6 +166,17 @@ class FormsDataApi extends asyncModules_1.default {
                 return field;
             }));
         }
+        // A failed upload used to be sent to the platform as the field's value, and the caller
+        // got a success: the form is not sent, the upload's error is the answer
+        const uploadError = formData[langCode]
+            .flatMap((field) => Array.isArray(field === null || field === void 0 ? void 0 : field.value) ? field.value : [field === null || field === void 0 ? void 0 : field.value])
+            .find((value) => this._isErrorResponse(value));
+        if (uploadError) {
+            if (this.state.isShell) {
+                return uploadError;
+            }
+            throw uploadError;
+        }
         // The wrapped formData goes into a new body: written back into the caller's
         // object, a second call with it wrapped the wrapper and answered `400` (CMS-1071)
         const result = await this._fetchPost(``, { ...body, formData });
@@ -272,7 +283,7 @@ class FormsDataApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms-data/getFormsDataByMarker getFormsDataByMarker} documentation.
      */
     async getFormsDataByMarker(marker, formModuleConfigId, body = {}, isExtended = 0, langCode = this.state.lang, offset = 0, limit = 30) {
-        const result = await this._fetchPost(`/marker/${this._pathSegment(marker)}?formModuleConfigId=${formModuleConfigId}&isExtended=${isExtended}&langCode=${langCode}&offset=${offset}&limit=${limit}`, this._stripEmptyDates(body));
+        const result = await this._fetchPost(`/marker/${this._pathSegment(marker)}?formModuleConfigId=${encodeURIComponent(String(formModuleConfigId))}&isExtended=${encodeURIComponent(String(isExtended))}&langCode=${encodeURIComponent(langCode)}&offset=${encodeURIComponent(String(offset))}&limit=${encodeURIComponent(String(limit))}`, this._stripEmptyDates(body));
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('FormsByMarkerDataResponseSchema'));
         return this._normalizeData(validated, langCode);
@@ -281,11 +292,27 @@ class FormsDataApi extends asyncModules_1.default {
      * Update one object of form data by id. Requires user authentication.
      * @handleName updateFormsDataByid
      * @param {number} id - Form data ID. Example: 1.
+     * @param {object} [body] - Form data to save: the same fields as in `postFormsData` (`formIdentifier`, `formModuleConfigId`, `moduleEntityIdentifier`, `replayTo`, `status`, `formData`). Default: `{}`.
+     * @example
+        {
+          "formIdentifier": "test-form",
+          "formModuleConfigId": 2,
+          "moduleEntityIdentifier": "blog",
+          "replayTo": null,
+          "status": "sent",
+          "formData": [
+            {
+              "marker": "name",
+              "type": "string",
+              "value": "Test"
+            }
+          ]
+        }
      * @returns {Promise<IUpdateFormsData | IError>} Returns an object containing the updated form data or an error object if there was an issue.
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms-data/updateFormsDataByid updateFormsDataByid} documentation.
      */
     async updateFormsDataByid(id, body = {}) {
-        const result = await this._fetchPut(`/${id}`, body);
+        const result = await this._fetchPut(`/${this._pathSegment(String(id))}`, body);
         // Validate response if validation is enabled
         const validated = await this._validateResponse(result, schema('UpdateFormsDataSchema'));
         return validated;
@@ -299,7 +326,7 @@ class FormsDataApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms-data/updateFormsDataStatusByid updateFormsDataStatusByid} documentation.
      */
     async updateFormsDataStatusByid(id, body = {}) {
-        const result = await this._fetchPut(`/${id}/update-status`, body);
+        const result = await this._fetchPut(`/${this._pathSegment(String(id))}/update-status`, body);
         return result;
     }
     /**
@@ -310,8 +337,8 @@ class FormsDataApi extends asyncModules_1.default {
      * @see {@link https://js-sdk.oneentry.cloud/docs/forms-data/deleteFormsDataByid deleteFormsDataByid} documentation.
      */
     async deleteFormsDataByid(id) {
-        const result = await this._fetchDelete(`/${id}`);
-        return result;
+        const result = await this._fetchDelete(`/${this._pathSegment(String(id))}`);
+        return this._asBoolean(result);
     }
     /**
      * Semantic (vector) search for form data.

package/dist/forms-data/formsDataInterfaces.d.ts

@@ -225,9 +225,14 @@ interface IFormDataEntity {
         "id": 1,
         "formIdentifier": "form",
         "time": "2025-06-06T19:07:45.993Z",
-        "formData": {},
-        "attributeSetIdentifier": "form",
-        "actionMessage": "Action message string"
+        "formData": [
+          {
+            "marker": "name",
+            "type": "string",
+            "value": "Test"
+          }
+        ],
+        "attributeSetIdentifier": "form"
       }
     ]
  * @property {number} total - Total number of found records. Example: 100.
@@ -241,13 +246,13 @@ interface IFormsDataEntity {
  * Represents the structure of a form data entity.
  * @interface IFormByMarkerDataEntity
  * @property {number} id - ID of the form data record. Example: 12345.
- * @property {null | number} parentId - ID of the parent form data record; `null` for a top-level record. Example: 123.
+ * @property {null | number} [parentId] - ID of the parent form data record; `null` for a top-level record. Returned only with `isExtended` = 1. Example: 123.
  * @property {string} formIdentifier - Marker of the form. Example: "contact_form".
- * @property {number} depth - Example: 1.
- * @property {string | null} ip - IP address the form was submitted from. Example: '127.0.0.1'.
- * @property {string | null} fingerprint - Device fingerprint of the sender. Example: 'fingerprint'.
- * @property {string | null} status - Moderation status of the record: "sent", "moderation", "approved", "banned" or "deleted"; `null` when the form does not moderate. Example: 'approved'.
- * @property {string | null} userIdentifier - Text identifier (marker) of the user. Example: "admin".
+ * @property {number} [depth] - Nesting depth of the record. Returned only with `isExtended` = 1. Example: 1.
+ * @property {string | null} [ip] - IP address the form was submitted from. Not returned by the by-marker list. Example: '127.0.0.1'.
+ * @property {string | null} [fingerprint] - Device fingerprint of the sender. Not returned by the by-marker list. Example: 'fingerprint'.
+ * @property {string | null} [status] - Moderation status of the record: "sent", "moderation", "approved", "banned" or "deleted"; `null` when the form does not moderate. Returned only with `isExtended` = 1. Example: 'approved'.
+ * @property {string | null} [userIdentifier] - Text identifier (marker) of the user. Returned only with `isExtended` = 1. Example: "admin".
  * @property {FormDataType[]} formData - Submitted fields, **already unwrapped from the locale**: the API returns `{ "en_US": [ … ] }` and the SDK hands over the array for the requested `langCode`. Read `formData` directly — `formData[langCode]` is `undefined`.
  * @example
     [
@@ -260,7 +265,7 @@ interface IFormsDataEntity {
  * @property {string | null} attributeSetIdentifier - Marker of the attribute set used by the form. Example: "product_attributes".
  * @property {Date | string} time - Date and time the form data was last changed. Example: "2023-10-01T12:00:00Z".
  * @property {string} entityIdentifier - Marker of the entity the record belongs to. Example: "test".
- * @property {boolean} isUserAdmin - Whether the record was submitted by an admin. Example: true.
+ * @property {boolean} [isUserAdmin] - Whether the record was submitted by an admin. Returned only with `isExtended` = 1. Example: true.
  * @property {number} formModuleConfigId - ID of the form module configuration. Example: 2.
  * @property {string} [moduleIdentifier] - Marker of the module. Example: "blog".
  * @property {number} entityId - ID of the entity the record belongs to. Example: 2.
@@ -287,7 +292,7 @@ interface IFormByMarkerDataEntity {
 /**
  * Represents a collection of form data entities.
  * @interface IFormsByMarkerDataEntity
- * @property {IFormByMarkerDataEntity[]} items - Form data records.
+ * @property {IFormByMarkerDataEntity[]} items - Form data records. The example shows a record with `isExtended` = 1; without it `parentId`, `depth`, `status`, `userIdentifier` and `isUserAdmin` are not returned.
  * @example
     [
       {
@@ -295,7 +300,6 @@ interface IFormByMarkerDataEntity {
         "parentId": null,
         "formIdentifier": "test-form",
         "depth": 0,
-        "ip": null,
         "status": null,
         "userIdentifier": null,
         "formData": [
@@ -862,4 +866,4 @@ interface IListOptionValue {
     value: string;
     extended: IListOptionExtended;
 }
-export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeEntity, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IBodyTypeTimeInterval, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };
+export type { FormDataPostType, FormDataStatus, FormDataType, IBodyPostFormData, IBodyPostTypeList, IBodyPostTypeSpam, IBodyPostTypeText, IBodyTypeEntity, IBodyTypeFile, IBodyTypeImageGroupOfImages, IBodyTypeRadioButtonList, IBodyTypeStringNumberFloat, IBodyTypeText, IBodyTypeTextWithHeader, IBodyTypeTimeDate, IBodyTypeTimeInterval, ICaptchaEvent, ICaptchaValue, IFileValue, IFormByMarkerDataEntity, IFormDataEntity, IFormDataSearchEntity, IFormsByMarkerDataEntity, IFormsData, IFormsDataEntity, IFormsDataFilter, IFormsDataSearchResponse, IFormsDataVectorSearch, IImageValue, IImageValueParams, IListOptionExtended, IListOptionValue, IPostFormResponse, IPostFormResponseData, ITextEditorParams, ITextSubmissionValue, ITextSubmissionValueHtml, ITextSubmissionValueMd, ITextSubmissionValuePlain, ITextValue, ITextWithHeaderValue, ITimeDateValue, IUpdateFormsData, };

package/dist/general-types/generalTypesInterfaces.d.ts

@@ -19,7 +19,7 @@ interface IGeneralTypes {
  * Represents a general type entity.
  * @interface IGeneralTypesEntity
  * @property {number} id - ID of the type. Example: 1.
- * @property {BlockType} type - Type name: a `BlockType` value such as `"product"` or `"service"`. Example: "product", "category", "etc".
+ * @property {BlockType} type - Type name: a `BlockType` value such as `"product"`, `"catalog_page"`, `"product_block"` or `"service"`. Example: "product".
  * @description Represents a general type entity with an identifier and a type.
  */
 interface IGeneralTypesEntity {

package/dist/index.d.ts

@@ -34,6 +34,7 @@ import WsApi from './web-socket/wsApi';
 export { getAdditionalFields, getAttributeFile, getAttributeFiles, isFileAttribute, isListAttribute, isNumberAttribute, isStringAttribute, } from './base/attributes';
 export { expandAttributeTimeIntervals, expandTimeIntervals, isTimeIntervalAttribute, } from './base/timeIntervals';
 export type * from './types';
+export type { IDefineApi };
 /**
  * IDefineApi interface
  * @interface IDefineApi
@@ -132,17 +133,17 @@ interface IDefineApi {
  * @function defineOneEntry
  * @param {string} url - URl of your project.
  * @param {IConfig} config - Custom configuration settings
- * @param {string} [config.token] - Optional token parameter
+ * @param {string} config.token - App token of the project. Required: `defineOneEntry` throws without it.
  * @param {string} [config.guestId] - Optional guest identifier sent as the `x-guest-id` header for guest cart/wishlist/activity flows (only while unauthenticated). In the browser, if omitted, a stable per-device id is generated and persisted in localStorage. On the server you MUST pass a per-visitor `guestId` (or call `setGuestId`): the SDK never auto-generates a server id, to avoid sharing one guest across visitors.
  * @param {string} [config.deviceMetadata] - Optional device-metadata string sent as the `x-device-metadata` header instead of the environment-derived fingerprint. Refresh tokens are bound to this header, so a server issuing tokens for a browser (OAuth code exchange) must pass the browser's string (from `getDeviceMetadata()`), or the token will not be refreshable from that browser.
- * @param {string} [config.langCode] - Optional langCode parameter
+ * @param {string} [config.langCode] - Optional default language. Default: 'en_US'.
  * @param {boolean} [config.traficLimit] - Some methods use multiple queries to make it easier to work with the API. Set it to `true` to save traffic and decide for yourself what data you need: the SDK then skips its follow-up requests, and some results change shape (e.g. `searchPage` returns short `{ id, title }` cards). Default: false.
- * @param {string} [config.auth] - An object with authorization settings.
+ * @param {object} [config.auth] - An object with authorization settings.
  * @param {boolean} [config.auth.customAuth] - Set this flag to true if you want to configure the authorization process yourself. Set the flag to false, or do not pass it at all to have automatic authorization and token renewal.
- * @param {string} [config.auth.refreshToken] - Transfer the refresh token here, for example from the local storage, to resume the user's session. Otherwise, the user will need to log in every time a new session is created.
+ * @param {string} [config.auth.refreshToken] - Transfer the refresh token here, for example from the local storage, to resume the user's session. Otherwise, the user will need to log in every time a new session is created. On the server, also pass the `deviceMetadata` saved with the token: the API binds refresh tokens to it.
  * @param {string} [config.auth.providerMarker] - The marker of the authorization provider.
- * @param {string} [config.auth.saveFunction] - If you want to store the token between sessions, for example in local storage, create a custom function that takes refreshToken as a parameter and executes the necessary instructions. This function will be called every time the tokens are updated.
+ * @param {function(string): void} [config.auth.saveFunction] - If you want to store the token between sessions, for example in local storage, create a custom function that takes refreshToken as a parameter and executes the necessary instructions. This function will be called every time the tokens are updated.
  * @returns {IDefineApi} List of methods set.
- * @description Define API.
+ * @description Define API. The returned client holds one session (tokens, guest id) shared by all its modules: on a server, create a client per request for user calls — a client shared between requests serves the signed-in user's data to every visitor. `logout` does not change the guest id.
  */
 export declare function defineOneEntry(url: string, config: IConfig): IDefineApi;

package/dist/index.js

@@ -50,23 +50,55 @@ var timeIntervals_1 = require("./base/timeIntervals");
 Object.defineProperty(exports, "expandAttributeTimeIntervals", { enumerable: true, get: function () { return timeIntervals_1.expandAttributeTimeIntervals; } });
 Object.defineProperty(exports, "expandTimeIntervals", { enumerable: true, get: function () { return timeIntervals_1.expandTimeIntervals; } });
 Object.defineProperty(exports, "isTimeIntervalAttribute", { enumerable: true, get: function () { return timeIntervals_1.isTimeIntervalAttribute; } });
+/**
+ * Checks the project URL every request path is appended to.
+ * @param {string} raw - The URL as passed, trimmed.
+ * @param {string} base - The URL with trailing `/` and `/api/content` removed.
+ * @returns {boolean} True for an http(s) origin (optionally with a path) or a same-origin proxy path.
+ * @description A backslash is read as `/` by browsers: `/\\evil.example` was a "path" that sent
+ * every request — and the app token — to another host. A query or fragment swallowed every
+ * path appended to it, and credentials in the URL make `fetch` throw on each call.
+ */
+function _isProjectUrl(raw, base) {
+    if (/[\\?#\s]/.test(base)) {
+        return false;
+    }
+    if (raw.startsWith('/')) {
+        // `/` and `/api/content` leave an empty base: the site's own origin
+        return !raw.startsWith('//') && (base === '' || base.startsWith('/'));
+    }
+    // `https:evil.example` parses with that host, but a browser resolves it as a path
+    if (!/^https?:\/\//i.test(base)) {
+        return false;
+    }
+    try {
+        const parsed = new URL(base);
+        return ((parsed.protocol === 'http:' || parsed.protocol === 'https:') &&
+            !!parsed.hostname &&
+            !parsed.username &&
+            !parsed.password);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Define API.
  * @function defineOneEntry
  * @param {string} url - URl of your project.
  * @param {IConfig} config - Custom configuration settings
- * @param {string} [config.token] - Optional token parameter
+ * @param {string} config.token - App token of the project. Required: `defineOneEntry` throws without it.
  * @param {string} [config.guestId] - Optional guest identifier sent as the `x-guest-id` header for guest cart/wishlist/activity flows (only while unauthenticated). In the browser, if omitted, a stable per-device id is generated and persisted in localStorage. On the server you MUST pass a per-visitor `guestId` (or call `setGuestId`): the SDK never auto-generates a server id, to avoid sharing one guest across visitors.
  * @param {string} [config.deviceMetadata] - Optional device-metadata string sent as the `x-device-metadata` header instead of the environment-derived fingerprint. Refresh tokens are bound to this header, so a server issuing tokens for a browser (OAuth code exchange) must pass the browser's string (from `getDeviceMetadata()`), or the token will not be refreshable from that browser.
- * @param {string} [config.langCode] - Optional langCode parameter
+ * @param {string} [config.langCode] - Optional default language. Default: 'en_US'.
  * @param {boolean} [config.traficLimit] - Some methods use multiple queries to make it easier to work with the API. Set it to `true` to save traffic and decide for yourself what data you need: the SDK then skips its follow-up requests, and some results change shape (e.g. `searchPage` returns short `{ id, title }` cards). Default: false.
- * @param {string} [config.auth] - An object with authorization settings.
+ * @param {object} [config.auth] - An object with authorization settings.
  * @param {boolean} [config.auth.customAuth] - Set this flag to true if you want to configure the authorization process yourself. Set the flag to false, or do not pass it at all to have automatic authorization and token renewal.
- * @param {string} [config.auth.refreshToken] - Transfer the refresh token here, for example from the local storage, to resume the user's session. Otherwise, the user will need to log in every time a new session is created.
+ * @param {string} [config.auth.refreshToken] - Transfer the refresh token here, for example from the local storage, to resume the user's session. Otherwise, the user will need to log in every time a new session is created. On the server, also pass the `deviceMetadata` saved with the token: the API binds refresh tokens to it.
  * @param {string} [config.auth.providerMarker] - The marker of the authorization provider.
- * @param {string} [config.auth.saveFunction] - If you want to store the token between sessions, for example in local storage, create a custom function that takes refreshToken as a parameter and executes the necessary instructions. This function will be called every time the tokens are updated.
+ * @param {function(string): void} [config.auth.saveFunction] - If you want to store the token between sessions, for example in local storage, create a custom function that takes refreshToken as a parameter and executes the necessary instructions. This function will be called every time the tokens are updated.
  * @returns {IDefineApi} List of methods set.
- * @description Define API.
+ * @description Define API. The returned client holds one session (tokens, guest id) shared by all its modules: on a server, create a client per request for user calls — a client shared between requests serves the signed-in user's data to every visitor. `logout` does not change the guest id.
  */
 function defineOneEntry(url, config) {
     if (typeof url !== 'string' || url.trim() === '') {
@@ -81,7 +113,18 @@ function defineOneEntry(url, config) {
             'Pass it via config, e.g. ' +
             'defineOneEntry("https://your-project.oneentry.cloud", { token: "your-app-token" }).');
     }
-    const stateModule = new stateModule_1.default(url.endsWith('/') ? url.slice(0, -1) : url, config);
+    // Trailing slashes and a copied `/api/content` suffix used to double up in every path
+    // (`//api/content/…`, `/api/content/api/content/…`) and fail each call with a 404
+    const baseUrl = url
+        .trim()
+        .replace(/\/+$/, '')
+        .replace(/\/api\/content$/i, '');
+    if (!_isProjectUrl(url.trim(), baseUrl)) {
+        throw new Error('OneEntry SDK: project URL must be an http(s) URL without credentials, query or fragment, ' +
+            'or a same-origin proxy path starting with "/", e.g. ' +
+            'defineOneEntry("https://your-project.oneentry.cloud", { token: "your-app-token" }).');
+    }
+    const stateModule = new stateModule_1.default(baseUrl, config);
     const Admins = new adminsApi_1.default(stateModule);
     const AttributesSets = new attributeSetsApi_1.default(stateModule);
     const AuthProvider = new authProviderApi_1.default(stateModule);