@faststore/core 3.100.1 → 3.100.3

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.100.0 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.100.0 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.100.0 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.100.0 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.100.0 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.100.0 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.100.0 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -83,9 +83,9 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
-./src/server/authentication-service.ts
+./src/server/password-protection-service.ts
 
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
 A Node.js API is used (DecompressionStream at line: 25) which is not supported in the Edge Runtime.
@@ -93,17 +93,17 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
-./src/server/authentication-service.ts
+./src/server/password-protection-service.ts
 
    Collecting page data ...
    Generating static pages (0/8) ...
 
   Generating static pages (2/8) 
 Search not found. Add a new component for this section or remove it from the CMS
+Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
 Search not found. Add a new component for this section or remove it from the CMS
 
   Generating static pages (4/8) 
-Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
 Search not found. Add a new component for this section or remove it from the CMS
 Search not found. Add a new component for this section or remove it from the CMS
 
   Generating static pages (6/8) 
@@ -123,16 +123,16 @@ Route (pages)                              Size     First Load JS
 ├   └ css/54cedf4b65e5863f.css             16.7 kB
 ├ ○ /404                                   1.58 kB         160 kB
 ├ ● /500                                   1.58 kB         160 kB
-├ λ /api/fs/auth/login                     0 B             109 kB
 ├ λ /api/fs/logout                         0 B             109 kB
+├ λ /api/fs/password-protection/unlock     0 B             109 kB
 ├ λ /api/graphql                           0 B             109 kB
 ├ λ /api/health/live                       0 B             109 kB
 ├ λ /api/health/ready                      0 B             109 kB
 ├ λ /api/preview                           0 B             109 kB
 ├ ● /checkout                              750 B           159 kB
-├ ○ /fs-auth-login                         2.17 kB         111 kB
-├   └ css/3bd4edd425711792.css             3.2 kB
 ├ ● /login                                 1.7 kB          160 kB
+├ ○ /password-protection                   2.18 kB         111 kB
+├   └ css/033b9397a0c0cf71.css             3.2 kB
 ├ λ /pvt/account                           247 B           109 kB
 ├ ● /pvt/account/[...unknown]              287 B           109 kB
 ├ λ /pvt/account/403                       3 kB            161 kB
@@ -152,9 +152,9 @@ Route (pages)                              Size     First Load JS
 └ ● /s                                     3.35 kB         176 kB
 + First Load JS shared by all              118 kB
   ├ chunks/framework-d514426edf885c68.js   45.4 kB
-  ├ chunks/main-083a618181bb5fbb.js        33.4 kB
+  ├ chunks/main-a2d1cfe626f2fef1.js        33.4 kB
   ├ chunks/pages/_app-35e8dda638ee2672.js  26.6 kB
-  ├ chunks/webpack-ff85816fb58111fa.js     3.9 kB
+  ├ chunks/webpack-25c67512e1907efd.js     3.9 kB
   └ css/146a8678babc61bf.css               9.2 kB
 
 ƒ Middleware                               44.8 kB

package/.turbo/turbo-test.log

@@ -1,20 +1,20 @@
 
-> @faststore/core@3.100.0 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.2 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/clearCookies.test.ts (12.099 s)
-PASS test/server/authentication-service.test.ts (15.26 s)
-PASS test/utils/cookieCacheBusting.test.ts (14.803 s)
+PASS test/utils/clearCookies.test.ts (9.746 s)
 PASS test/utils/multipleTemplates.test.ts
-PASS test/utils/validateSessionRefreshToken.test.ts
+PASS test/server/password-protection-service.test.ts (16.656 s)
+PASS test/utils/cookieCacheBusting.test.ts (15.853 s)
 PASS test/server/cms/global.test.ts
+PASS test/utils/validateSessionRefreshToken.test.ts
 PASS test/utils/isLocalHost.test.ts
+PASS test/server/cms/index.test.ts
 PASS test/utils/isLocalHost.browser.test.ts
-PASS test/server/cms/index.test.ts (5.171 s)
-PASS test/server/index.test.ts (10.14 s)
+PASS test/server/index.test.ts (11.788 s)
 
 Test Suites: 10 passed, 10 total
 Tests:       85 passed, 85 total
 Snapshots:   0 total
-Time:        26.32 s
+Time:        27.32 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.100.3](https://github.com/vtex/faststore/compare/v3.100.2...v3.100.3) (2026-06-30)
+
+### Bug Fixes
+
+- align password-protection vocabulary in v3 (unlock, not login) ([#3404](https://github.com/vtex/faststore/issues/3404)) ([30222fc](https://github.com/vtex/faststore/commit/30222fcde2b180eb3ded421949a2359917ba53d4)), closes [#3276](https://github.com/vtex/faststore/issues/3276)
+
+## [3.100.2](https://github.com/vtex/faststore/compare/v3.100.1...v3.100.2) (2026-06-11)
+
+### Bug Fixes
+
+- paginate listEntries with scroll ([#3384](https://github.com/vtex/faststore/issues/3384)) ([83fdae8](https://github.com/vtex/faststore/commit/83fdae826f8fd3e1f739887b21b529598f325cb6))
+
 ## [3.100.1](https://github.com/vtex/faststore/compare/v3.100.0...v3.100.1) (2026-06-08)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.100.1",
+  "version": "3.100.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -75,7 +75,7 @@
     "@parcel/watcher": "^2.4.0",
     "@types/react": "^18.2.42",
     "@vtex/client-cms": "^0.2.16",
-    "@vtex/client-cp": "0.3.5",
+    "@vtex/client-cp": "0.6.0",
     "@vtex/prettier-config": "1.0.0",
     "autoprefixer": "^10.4.0",
     "cookie": "^0.7.0",
@@ -127,5 +127,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "27db589ac8c79b484b9faddda2ef8e445ddc882b"
+  "gitHead": "bf4812f3e3a53108f22ab987098b74f7eed9bfa3"
 }

package/src/middleware.ts

@@ -1,6 +1,6 @@
 /*
  * Middleware is always active. It runs:
- * 1. Password protection (AuthenticationService) — when applicable (default/custom domains per env).
+ * 1. Password protection (PasswordProtectionService) — when applicable (default/custom domains per env).
  * 2. Redirects — only when ENABLE_REDIRECTS_MIDDLEWARE is set at runtime.
  */
 
@@ -8,7 +8,7 @@ import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 import storeConfig from 'discovery.config'
 
-import { AuthenticationService } from './server/authentication-service'
+import { PasswordProtectionService } from './server/password-protection-service'
 
 type Redirect = {
   from: string
@@ -31,19 +31,20 @@ const redirectsClient = new DynamoRedirectsClient()
 export async function middleware(request: NextRequest) {
   const path = request.nextUrl.pathname
 
-  let authResult: Awaited<
-    ReturnType<AuthenticationService['authenticateRequest']>
+  let storeProtectionResult: Awaited<
+    ReturnType<PasswordProtectionService['checkStoreProtection']>
   >
 
   try {
-    const authService = new AuthenticationService()
-    authResult = await authService.authenticateRequest(request)
+    const protectionService = new PasswordProtectionService()
+    storeProtectionResult =
+      await protectionService.checkStoreProtection(request)
   } catch {
     return NextResponse.error()
   }
 
-  if (authResult.response.status !== 200) {
-    return authResult.response
+  if (storeProtectionResult.response.status !== 200) {
+    return storeProtectionResult.response
   }
 
   if (process.env.ENABLE_REDIRECTS_MIDDLEWARE === 'true') {
@@ -54,7 +55,7 @@ export async function middleware(request: NextRequest) {
       const redirectStatusCode = redirect.type === 'permanent' ? 301 : 302
       const response = NextResponse.redirect(redirectUrl, redirectStatusCode)
 
-      for (const cookie of authResult.response.cookies.getAll()) {
+      for (const cookie of storeProtectionResult.response.cookies.getAll()) {
         response.cookies.set(cookie)
       }
 
@@ -67,7 +68,7 @@ export async function middleware(request: NextRequest) {
     }
   }
 
-  return authResult.response
+  return storeProtectionResult.response
 }
 
 export const config = {
@@ -75,13 +76,13 @@ export const config = {
     /*
      * Match all paths including `/`
      * Exclude:
-     * - api (e.g. api/fs/auth/login)
+     * - api (e.g. api/fs/password-protection/unlock)
      * - _next/static, _next/image
      * - favicon.ico
-     * - fs-auth-login (login page)
+     * - password-protection (unlock page)
      * - ~partytown (partytown scripts)
      */
     '/',
-    '/((?!api|_next/static|_next/image|favicon.ico|fs-auth-login|~partytown).*)',
+    '/((?!api|_next/static|_next/image|favicon.ico|password-protection|~partytown).*)',
   ],
 }

package/src/pages/api/fs/{auth/login.ts → password-protection/unlock.ts}

@@ -2,7 +2,7 @@ import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next'
 
 import storeConfig from 'discovery.config'
 
-import type { LoginResponse } from '../../../../utils/loginResponse'
+import type { UnlockResponse } from '../../../../utils/unlockResponse'
 import {
   sessionUrl,
   passwordProtectionTimeouts,
@@ -10,7 +10,7 @@ import {
 import {
   COOKIE_NAME,
   TOKEN_TTL_SECONDS,
-} from 'src/server/authentication-service'
+} from 'src/server/password-protection-service'
 
 interface WebOpsSessionPayload {
   valid: boolean
@@ -36,9 +36,9 @@ const isWebOpsSessionPayload = (
   )
 }
 
-const handler: NextApiHandler<LoginResponse> = async (
+const handler: NextApiHandler<UnlockResponse> = async (
   request: NextApiRequest,
-  response: NextApiResponse<LoginResponse>
+  response: NextApiResponse<UnlockResponse>
 ) => {
   if (request.method !== 'POST') {
     response.status(405).end()

package/src/pages/{fs-auth-login → password-protection}/index.tsx

@@ -3,8 +3,8 @@ import Head from 'next/head'
 import { useRouter } from 'next/router'
 import { type FormEvent, useState } from 'react'
 
-import { isLoginResponse } from '../../utils/loginResponse'
-import styles from './fs-auth-login.module.scss'
+import { isUnlockResponse } from '../../utils/unlockResponse'
+import styles from './password-protection.module.scss'
 
 export default function PasswordProtectionLogin() {
   const router = useRouter()
@@ -21,7 +21,10 @@ export default function PasswordProtectionLogin() {
     setError('')
 
     try {
-      const url = new URL('/api/fs/auth/login', globalThis.location.origin)
+      const url = new URL(
+        '/api/fs/password-protection/unlock',
+        globalThis.location.origin
+      )
       url.searchParams.set('returnTo', returnTo)
 
       const response = await fetch(url.toString(), {
@@ -32,7 +35,7 @@ export default function PasswordProtectionLogin() {
 
       const data: unknown = await response.json()
 
-      if (!isLoginResponse(data)) {
+      if (!isUnlockResponse(data)) {
         setError('Service temporarily unavailable')
         return
       }
@@ -50,7 +53,7 @@ export default function PasswordProtectionLogin() {
   }
 
   return (
-    <div className={styles.fsAuthLogin}>
+    <div className={styles.fsPasswordProtection}>
       <Head>
         <meta name="robots" content="noindex,nofollow" />
       </Head>
@@ -63,7 +66,7 @@ export default function PasswordProtectionLogin() {
 
         <form className={styles.form} onSubmit={handleSubmit}>
           <InputField
-            id="fs-auth-password"
+            id="password-protection-input"
             label="Password"
             type="password"
             value={password}
@@ -81,7 +84,7 @@ export default function PasswordProtectionLogin() {
             disabled={loading}
             loading={loading}
           >
-            Login
+            Unlock
           </Button>
         </form>
       </div>

package/src/pages/{fs-auth-login/fs-auth-login.module.scss → password-protection/password-protection.module.scss}

@@ -1,5 +1,5 @@
 @layer components {
-  .fsAuthLogin {
+  .fsPasswordProtection {
     @import "@faststore/ui/src/components/atoms/Button/styles.scss";
     @import "@faststore/ui/src/components/atoms/Input/styles.scss";
     @import "@faststore/ui/src/components/atoms/Loader/styles.scss";

package/src/server/content/service.ts

@@ -46,8 +46,29 @@ export class ContentService {
 
     if (isContentPlatformSource()) {
       const serviceParams = this.convertOptionsToParams(options)
-      const { entries } = await this.clientCP.listEntries(serviceParams)
-      return this.fillEntriesWithData(entries, serviceParams, options.isPreview)
+      // TODO: This should be temporary until the cp data-plane have a search engine.
+      const MAX_PAGES = 25
+      const allEntries: ContentEntry[] = []
+      let scroll: string | undefined
+      let pages = 0
+
+      do {
+        const result = await this.clientCP.listEntries(serviceParams, scroll)
+        allEntries.push(...result.entries)
+        const next = result.scroll ?? undefined
+        if (next && next === scroll) break
+        scroll = next
+      } while (scroll && ++pages < MAX_PAGES)
+
+      if (pages >= MAX_PAGES) {
+        console.warn('listEntries pagination hit MAX_PAGES cap', serviceParams)
+      }
+
+      return this.fillEntriesWithData(
+        allEntries,
+        serviceParams,
+        options.isPreview
+      )
     }
     return getCMSPage(options.cmsOptions)
   }
@@ -60,6 +81,11 @@ export class ContentService {
     const options = this.createContentOptions(plpParams)
 
     if (isContentPlatformSource()) {
+      const directMatch = await this.getSingleContent<PLPContentType>(plpParams)
+      if (directMatch) {
+        return directMatch
+      }
+
       const pages = (await this.getMultipleContent(plpParams)).data
       if (!pages?.length) throw new MissingContentError(options.cmsOptions)
       return findBestPLPTemplate(
@@ -79,6 +105,11 @@ export class ContentService {
     const options = this.createContentOptions(pdpParams)
 
     if (isContentPlatformSource()) {
+      const directMatch = await this.getSingleContent<PDPContentType>(pdpParams)
+      if (directMatch) {
+        return directMatch
+      }
+
       const pages = (await this.getMultipleContent(pdpParams)).data
       if (!pages.length) throw new MissingContentError(options.cmsOptions)
       return findBestPDPTemplate(

package/src/server/{authentication-service.ts → password-protection-service.ts}

@@ -12,7 +12,7 @@ import {
   passwordProtectionTimeouts,
 } from './password-protection/webops-api'
 
-export const COOKIE_NAME = '__fs_auth_token'
+export const COOKIE_NAME = '__fs_password_protection'
 export const TOKEN_TTL_SECONDS = 10 * 60
 /** How long to reuse the RSA public key fetched from WebOps */
 const PUBLIC_KEY_CACHE_MS = 60 * 60 * 1000
@@ -25,7 +25,7 @@ interface TokenPayload {
   exp?: number
 }
 
-interface AuthResult {
+interface StoreProtectionResult {
   response: NextResponse
 }
 
@@ -73,7 +73,7 @@ export function resetPasswordProtectionPublicKeyCacheForTests(): void {
   publicKeyCache = null
 }
 
-export class AuthenticationService {
+export class PasswordProtectionService {
   private readonly storeId: string
 
   constructor() {
@@ -85,7 +85,9 @@ export class AuthenticationService {
     return host.split(':')[0].toLowerCase()
   }
 
-  async authenticateRequest(request: NextRequest): Promise<AuthResult> {
+  async checkStoreProtection(
+    request: NextRequest
+  ): Promise<StoreProtectionResult> {
     if (!this.shouldCheckProtection(request)) {
       return { response: NextResponse.next() }
     }
@@ -104,7 +106,7 @@ export class AuthenticationService {
       }
     }
 
-    return await this.handleNoAuth(request)
+    return await this.handleProtectionCheck(request)
   }
 
   private shouldCheckProtection(request: NextRequest): boolean {
@@ -182,7 +184,7 @@ export class AuthenticationService {
     request: NextRequest,
     expiredToken: string,
     payload: TokenPayload
-  ): Promise<AuthResult> {
+  ): Promise<StoreProtectionResult> {
     try {
       const res = await fetch(renewUrl(), {
         method: 'POST',
@@ -199,7 +201,7 @@ export class AuthenticationService {
 
         if (data.valid && data.token) {
           const response = NextResponse.next()
-          this.setAuthCookie(response, data.token)
+          this.setProtectionCookie(response, data.token)
 
           return { response }
         }
@@ -212,17 +214,19 @@ export class AuthenticationService {
       return { response: NextResponse.next() }
     }
 
-    return { response: this.redirectToLogin(request) }
+    return { response: this.redirectToUnlockPage(request) }
   }
 
-  private async handleNoAuth(request: NextRequest): Promise<AuthResult> {
+  private async handleProtectionCheck(
+    request: NextRequest
+  ): Promise<StoreProtectionResult> {
     try {
       const res = await fetch(protectionStatusUrl(), {
         signal: AbortSignal.timeout(passwordProtectionTimeouts.defaultMs),
       })
 
       if (!res.ok) {
-        return { response: this.redirectToLogin(request) }
+        return { response: this.redirectToUnlockPage(request) }
       }
 
       const status = await res.json()
@@ -231,7 +235,7 @@ export class AuthenticationService {
         const response = NextResponse.next()
 
         if (status.token) {
-          this.setAuthCookie(response, status.token)
+          this.setProtectionCookie(response, status.token)
         }
 
         return { response }
@@ -241,13 +245,13 @@ export class AuthenticationService {
         return { response: NextResponse.next() }
       }
 
-      return { response: this.redirectToLogin(request) }
+      return { response: this.redirectToUnlockPage(request) }
     } catch {
-      return { response: this.redirectToLogin(request) }
+      return { response: this.redirectToUnlockPage(request) }
     }
   }
 
-  private setAuthCookie(response: NextResponse, token: string): void {
+  private setProtectionCookie(response: NextResponse, token: string): void {
     response.cookies.set(COOKIE_NAME, token, {
       httpOnly: true,
       secure: true,
@@ -257,12 +261,12 @@ export class AuthenticationService {
     })
   }
 
-  private redirectToLogin(request: NextRequest): NextResponse {
-    const loginUrl = new URL('/fs-auth-login', request.url)
+  private redirectToUnlockPage(request: NextRequest): NextResponse {
+    const unlockUrl = new URL('/password-protection', request.url)
     const returnTo = `${request.nextUrl.pathname}${request.nextUrl.search}`
-    loginUrl.searchParams.set('returnTo', returnTo)
+    unlockUrl.searchParams.set('returnTo', returnTo)
 
-    const response = NextResponse.redirect(loginUrl)
+    const response = NextResponse.redirect(unlockUrl)
     response.headers.set('Cache-Control', 'no-store')
 
     return response

package/src/utils/{loginResponse.ts → unlockResponse.ts}

@@ -1,17 +1,22 @@
-export interface LoginResponse {
+export interface UnlockResponse {
   success?: boolean
   redirectUrl?: string
   error?: string
 }
 
-export const isLoginResponse = (data: unknown): data is LoginResponse => {
+export const isUnlockResponse = (data: unknown): data is UnlockResponse => {
   if (typeof data !== 'object' || data === null || Array.isArray(data)) {
     return false
   }
 
   const payload = data as Record<string, unknown>
+  const hasUnlockResponseField =
+    payload.success !== undefined ||
+    payload.redirectUrl !== undefined ||
+    payload.error !== undefined
 
   return (
+    hasUnlockResponseField &&
     (payload.success === undefined || typeof payload.success === 'boolean') &&
     (payload.redirectUrl === undefined ||
       typeof payload.redirectUrl === 'string') &&