@faststore/core 3.100.4 → 3.100.7

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.100.3 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.100.3 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.100.3 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.100.3 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.100.3 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.100.3 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.100.3 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -58,7 +58,7 @@ Browserslist: caniuse-lite is outdated. Please run:
    Creating an optimized production build ...
    Disabled SWC as replacement for Babel because of custom Babel configuration ".babelrc.js" https://nextjs.org/docs/messages/swc-disabled
    Using external babel configuration from /home/runner/work/faststore/faststore/packages/core/.babelrc.js
-Browserslist: browsers data (caniuse-lite) is 19 months old. Please run:
+Browserslist: browsers data (caniuse-lite) is 21 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
 <w> [webpack.cache.PackFileCacheStrategy] Skipped not serializable cache item 'Compilation/modules|/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/css-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[1]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/postcss-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[2]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/resolve-url-loader/index.js??ruleSet[1].rules[7].oneOf[9].use[3]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/compiled/sass-loader/cjs.js??ruleSet[1].rules[7].oneOf[9].use[4]!/home/runner/work/faststore/faststore/packages/core/src/components/common/Toast/section.module.scss': No serializer registered for Warning
@@ -83,7 +83,7 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
 ./src/server/password-protection-service.ts
 
@@ -93,7 +93,7 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
 ./src/server/password-protection-service.ts
 
@@ -154,7 +154,7 @@ Route (pages)                              Size     First Load JS
   ├ chunks/framework-d514426edf885c68.js   45.4 kB
   ├ chunks/main-a2d1cfe626f2fef1.js        33.4 kB
   ├ chunks/pages/_app-35e8dda638ee2672.js  26.6 kB
-  ├ chunks/webpack-6a844a3f6a390f62.js     3.9 kB
+  ├ chunks/webpack-bde714c56fd09a0c.js     3.9 kB
   └ css/146a8678babc61bf.css               9.2 kB
 
 ƒ Middleware                               44.8 kB

package/.turbo/turbo-test.log

@@ -1,21 +1,23 @@
 
-> @faststore/core@3.100.3 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.6 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/clearCookies.test.ts (11.489 s)
-PASS test/utils/cookieCacheBusting.test.ts (13.647 s)
+PASS test/server/content/service.test.ts (15.95 s)
+PASS test/utils/cookieCacheBusting.test.ts (15.164 s)
+PASS test/server/password-protection-service.test.ts (17.702 s)
 PASS test/utils/multipleTemplates.test.ts
-PASS test/server/password-protection-service.test.ts (16.602 s)
+PASS test/utils/clearCookies.test.ts
 PASS test/sdk/redirects/index.test.ts
+PASS test/utils/trustedForwardedHost.test.ts
 PASS test/utils/validateSessionRefreshToken.test.ts
 PASS test/server/cms/global.test.ts
 PASS test/utils/isLocalHost.test.ts
 PASS test/utils/isLocalHost.browser.test.ts
-PASS test/server/cms/index.test.ts (5.293 s)
-PASS test/server/index.test.ts (10.491 s)
+PASS test/server/cms/index.test.ts
+PASS test/server/index.test.ts (9.929 s)
 
-Test Suites: 11 passed, 11 total
-Tests:       92 passed, 92 total
+Test Suites: 13 passed, 13 total
+Tests:       128 passed, 128 total
 Snapshots:   0 total
-Time:        27.151 s
+Time:        28.81 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.100.7](https://github.com/vtex/faststore/compare/v3.100.6...v3.100.7) (2026-10-26)
+
+### Bug Fixes
+
+- **core:** cache Content Platform template list across page generations (3.x) ([#3534](https://github.com/vtex/faststore/issues/3534)) ([825c176](https://github.com/vtex/faststore/commit/825c176357b0f40ac9d112ee9789dce0c8198cf0)), closes [#3526](https://github.com/vtex/faststore/issues/3526) [#3384](https://github.com/vtex/faststore/issues/3384) [#3526](https://github.com/vtex/faststore/issues/3526) [#3526](https://github.com/vtex/faststore/issues/3526) [#3384](https://github.com/vtex/faststore/issues/3384)
+
+## [3.100.6](https://github.com/vtex/faststore/compare/v3.100.5...v3.100.6) (2026-10-07)
+
+### Bug Fixes
+
+- address security & functional concerns from dk review (3.x backport) ([c928a1f](https://github.com/vtex/faststore/commit/c928a1fc04bc3554d83302c4cf760adab0f7e81c))
+- **core:** harden x-forwarded-host handling and drop orderNumber fallback ([55990c1](https://github.com/vtex/faststore/commit/55990c1c6208c06ae482e71816df2035292bf2e9)), closes [#3178](https://github.com/vtex/faststore/issues/3178)
+- **core:** ignore multi-value x-forwarded-host and cover port and case ([81ba26b](https://github.com/vtex/faststore/commit/81ba26b93175878b9cc3e32683f9c13b0abf25e9))
+- **core:** log ignored x-forwarded-host and cover CR/LF hostnames ([e6a326f](https://github.com/vtex/faststore/commit/e6a326f6d0d4a91c75b9f0a10abfdc7c22c897be))
+- **core:** make preview cookies host-only instead of rewriting their domain ([989fc69](https://github.com/vtex/faststore/commit/989fc69c573c980e354d11e3c3d8a719e2833fb2))
+- **core:** reject hostnames that would inject Set-Cookie attributes ([109d819](https://github.com/vtex/faststore/commit/109d81917e1200dd78b9500f4cb81d128c78003d))
+- resolve ValidateCartMutation infinite loop in preview environments (SFS-3034) ([ad7800d](https://github.com/vtex/faststore/commit/ad7800d65493c7477c9fb30119f76925647c40fc)), closes [#3178](https://github.com/vtex/faststore/issues/3178) [#3178](https://github.com/vtex/faststore/issues/3178) [#3190](https://github.com/vtex/faststore/issues/3190) [#3188](https://github.com/vtex/faststore/issues/3188) [#1467584](https://github.com/vtex/faststore/issues/1467584)
+
 ## [3.100.4](https://github.com/vtex/faststore/compare/v3.100.3...v3.100.4) (2026-08-28)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.100.4",
+  "version": "3.100.7",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -127,5 +127,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "b30af2d573626311c245c445860a45cb26478798"
+  "gitHead": "fc9b34b4fc943c17e225249677b49e393dc2d1f4"
 }

package/src/pages/api/graphql.ts

@@ -10,6 +10,11 @@ import type { NextApiHandler, NextApiRequest } from 'next'
 import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { isLocalHost } from 'src/utils/isLocalHost'
+import {
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 
@@ -20,24 +25,45 @@ const ALLOWED_HOST_SUFFIXES = ['localhost', '.vtex.app', '.localhost']
 // Example: "Set-Cookie: key=value; Domain=example.com; Path=/"
 const MATCH_DOMAIN_REGEXP = /(?:^|;\s*)(?:domain=)([^;]+)/i
 
+const toHostname = (hostHeader: string | undefined) => {
+  const trimmed = hostHeader?.trim()
+  if (!trimmed) {
+    return null
+  }
+
+  try {
+    return new URL(`https://${trimmed}`).hostname
+  } catch {
+    return null
+  }
+}
+
 /**
- * Extracts hostname from the incoming request.
+ * Extracts hostname from the incoming request. The preview ingress forwards a
+ * client-supplied x-forwarded-host as is, so it only decides whether the cookie
+ * Domain is dropped, never which domain is used. A multi-value header is
+ * ignored; a single value is used only if it is on the allowlist.
  */
 const getRequestHostname = ({
   request,
 }: {
   request: NextApiRequest
 }): string | null => {
-  const hostHeader = request.headers.host?.trim()
-  if (!hostHeader) {
-    return null
+  const forwardedHeader = request.headers['x-forwarded-host']
+  const forwardedHostname = toHostname(singleForwardedHost(forwardedHeader))
+  if (forwardedHeader && !forwardedHostname) {
+    // The value is client-controllable, so it is not logged.
+    console.warn('Ignoring multi-value or malformed x-forwarded-host')
   }
 
-  try {
-    return new URL(`https://${hostHeader}`).hostname
-  } catch {
-    return null
+  if (
+    forwardedHostname &&
+    isHostAllowed(forwardedHostname, ALLOWED_HOST_SUFFIXES)
+  ) {
+    return forwardedHostname
   }
+
+  return toHostname(request.headers.host)
 }
 
 /**
@@ -57,22 +83,10 @@ const shouldReplaceCookieDomain = ({
 }
 
 /**
- * Determines if host is eligible for domain normalization.
- */
-const isAllowedHost = ({
-  host,
-  allowList,
-}: {
-  host: string
-  allowList: string[]
-}) => {
-  const normalizedHost = host.toLowerCase()
-
-  return allowList.some((suffix) => normalizedHost.endsWith(suffix))
-}
-
-/**
- * Ensure the cookie domain matches the current host so the browser can store it.
+ * On allowlisted hosts (previews, localhost) the upstream cookie domain does not
+ * match the browser host, so the Domain attribute is dropped and the cookie
+ * becomes host-only. The host is never written into the cookie, so a forged
+ * x-forwarded-host cannot choose the cookie scope.
  */
 const normalizeSetCookieDomain = ({
   request,
@@ -93,13 +107,13 @@ const normalizeSetCookieDomain = ({
   const cookieDomain = domainMatch[1]
 
   if (
-    !isAllowedHost({ host, allowList: ALLOWED_HOST_SUFFIXES }) ||
+    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
   }
 
-  return setCookie.replace(MATCH_DOMAIN_REGEXP, `; domain=${host}`)
+  return removeCookieDomain(setCookie)
 }
 
 const parseRequest = (request: NextApiRequest) => {

package/src/server/content/service.ts

@@ -19,9 +19,20 @@ import { isBranchPreview, isContentPlatformSource } from './utils'
 
 type ContentResult = ContentData | (ContentEntry & PageContentType)
 
+type ContentListCacheEntry = {
+  expiresAt: number
+  promise: Promise<{ data: ContentResult[] }>
+}
+
+// Bounds how stale the template list can get in long-lived processes (ISR);
+// a CMS publish already triggers a new build.
+const CONTENT_LIST_CACHE_TTL_MS = 5 * 60 * 1000
+
 export class ContentService {
   private clientCP: ClientCP
 
+  private readonly contentListCache = new Map<string, ContentListCacheEntry>()
+
   constructor() {
     this.clientCP = new ClientCP({
       tenant: config.api.storeId,
@@ -46,29 +57,12 @@ export class ContentService {
 
     if (isContentPlatformSource()) {
       const serviceParams = this.convertOptionsToParams(options)
-      // TODO: This should be temporary until the cp data-plane have a search engine.
-      const MAX_PAGES = 25
-      const allEntries: ContentEntry[] = []
-      let scroll: string | undefined
-      let pages = 0
-
-      do {
-        const result = await this.clientCP.listEntries(serviceParams, scroll)
-        allEntries.push(...result.entries)
-        const next = result.scroll ?? undefined
-        if (next && next === scroll) break
-        scroll = next
-      } while (scroll && ++pages < MAX_PAGES)
-
-      if (pages >= MAX_PAGES) {
-        console.warn('listEntries pagination hit MAX_PAGES cap', serviceParams)
+
+      if (options.isPreview) {
+        return this.listAndFillEntries(serviceParams, true)
       }
 
-      return this.fillEntriesWithData(
-        allEntries,
-        serviceParams,
-        options.isPreview
-      )
+      return this.getCachedContentList(serviceParams)
     }
     return getCMSPage(options.cmsOptions)
   }
@@ -136,6 +130,60 @@ export class ContentService {
     }
   }
 
+  private getCachedContentList(
+    serviceParams: EntryPathParams
+  ): Promise<{ data: ContentResult[] }> {
+    // listEntries only depends on these fields; the page slug must stay out of the key.
+    const { accountName, storeId, contentType, locale } = serviceParams
+    const key = JSON.stringify([accountName, storeId, contentType, locale])
+
+    const cached = this.contentListCache.get(key)
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.promise
+    }
+
+    const promise = this.listAndFillEntries(serviceParams, false).catch(
+      (err: unknown) => {
+        if (this.contentListCache.get(key)?.promise === promise) {
+          this.contentListCache.delete(key)
+        }
+        throw err
+      }
+    )
+
+    this.contentListCache.set(key, {
+      expiresAt: Date.now() + CONTENT_LIST_CACHE_TTL_MS,
+      promise,
+    })
+
+    return promise
+  }
+
+  private async listAndFillEntries(
+    serviceParams: EntryPathParams,
+    isPreview: boolean
+  ): Promise<{ data: (ContentEntry & PageContentType)[] }> {
+    // TODO: This should be temporary until the cp data-plane have a search engine.
+    const MAX_PAGES = 25
+    const allEntries: ContentEntry[] = []
+    let scroll: string | undefined
+    let pages = 0
+
+    do {
+      const result = await this.clientCP.listEntries(serviceParams, scroll)
+      allEntries.push(...result.entries)
+      const next = result.scroll ?? undefined
+      if (next && next === scroll) break
+      scroll = next
+    } while (scroll && ++pages < MAX_PAGES)
+
+    if (pages >= MAX_PAGES) {
+      console.warn('listEntries pagination hit MAX_PAGES cap', serviceParams)
+    }
+
+    return this.fillEntriesWithData(allEntries, serviceParams, isPreview)
+  }
+
   private async fillEntriesWithData(
     entries: ContentEntry[],
     serviceParams: EntryPathParams,

package/src/utils/trustedForwardedHost.ts

@@ -0,0 +1,50 @@
+// The result is written verbatim into a Set-Cookie Domain attribute, so
+// characters such as ";" or spaces would inject cookie attributes.
+const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
+
+/**
+ * An entry starting with "." matches subdomains only; any other entry matches
+ * the host itself and its subdomains. Matching is anchored on a label boundary,
+ * so "evil-localhost" never matches "localhost".
+ */
+export function isHostAllowed(host: string, allowList: string[]) {
+  const normalizedHost = host.toLowerCase()
+
+  if (!HOSTNAME_PATTERN.test(normalizedHost)) {
+    return false
+  }
+
+  return allowList.some((entry) =>
+    entry.startsWith('.')
+      ? normalizedHost.endsWith(entry)
+      : normalizedHost === entry || normalizedHost.endsWith(`.${entry}`)
+  )
+}
+
+/**
+ * Returns the `x-forwarded-host` value only when exactly one is present.
+ *
+ * Which hop of a proxy chain is trustworthy is not known here: with several
+ * values the leftmost one is whatever the client sent. So a multi-value header
+ * (comma-joined by Node, or an array) is ignored and the caller falls back to
+ * `host`. A single value still assumes the ingress overwrites the header.
+ */
+export function singleForwardedHost(
+  header: string | string[] | undefined
+): string | undefined {
+  if (Array.isArray(header)) {
+    return header.length === 1 ? singleForwardedHost(header[0]) : undefined
+  }
+
+  const value = header?.trim()
+
+  return value && !value.includes(',') ? value : undefined
+}
+
+/**
+ * Drops every Domain attribute so the cookie becomes host-only: the browser
+ * scopes it to the exact host it requested, whatever header picked this path.
+ */
+export function removeCookieDomain(setCookie: string): string {
+  return setCookie.replaceAll(/;\s*domain=[^;]*/gi, '')
+}

package/test/server/content/service.test.ts

@@ -0,0 +1,222 @@
+import type { ContentEntry, EntryPathParams } from '@vtex/client-cp'
+
+import { ContentService } from '../../../src/server/content/service'
+import type { ContentParams } from '../../../src/server/content/types'
+
+jest.mock('../../../src/server/content/utils', () => ({
+  ...jest.requireActual('../../../src/server/content/utils'),
+  isContentPlatformSource: jest.fn(() => true),
+}))
+
+const NOT_FOUND = 'Request failed with status code 404'
+const FIVE_MINUTES = 5 * 60 * 1000
+
+const entryData: Record<string, Record<string, unknown>> = {
+  generic: { sections: [{ name: 'Generic' }] },
+  collection: {
+    settings: { template: { value: '/colecao' } },
+    sections: [{ name: 'Collection' }],
+  },
+  other: {
+    settings: { template: { value: '/outra' } },
+    sections: [{ name: 'Other' }],
+  },
+}
+
+const toEntry = (id: string) => ({ id, name: id }) as ContentEntry
+
+function createFakeClientCP(pages: string[][]) {
+  return {
+    listEntries: jest.fn(async (_params: EntryPathParams, scroll?: string) => {
+      const index = scroll ? Number(scroll) : 0
+      return {
+        entries: pages[index].map(toEntry),
+        scroll: index + 1 < pages.length ? String(index + 1) : null,
+      }
+    }),
+    getEntry: jest.fn(async ({ entryId }: EntryPathParams) => ({
+      ...entryData[entryId as string],
+    })),
+    previewEntryById: jest.fn(async ({ entryId }: EntryPathParams) => ({
+      ...entryData[entryId as string],
+    })),
+    getEntryBySlug: jest.fn(
+      async (_params: EntryPathParams): Promise<Record<string, unknown>> => {
+        throw new Error(NOT_FOUND)
+      }
+    ),
+    previewEntryBySlug: jest.fn(
+      async (_params: EntryPathParams): Promise<Record<string, unknown>> => {
+        throw new Error(NOT_FOUND)
+      }
+    ),
+  }
+}
+
+function createServiceWithClient(
+  pages: string[][] = [['generic', 'collection', 'other']]
+) {
+  const service = new ContentService()
+  const clientCP = createFakeClientCP(pages)
+  Object.defineProperty(service, 'clientCP', { value: clientCP })
+  return { service, clientCP }
+}
+
+describe('ContentService Content Platform template list cache', () => {
+  beforeEach(() => {
+    jest.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+    jest.useRealTimers()
+  })
+
+  it('shares one list and entry fetch across concurrent PLPs with different slugs', async () => {
+    const { service, clientCP } = createServiceWithClient()
+
+    const [collectionPage, otherPage, unknownPage] = await Promise.all([
+      service.getPlpContent({ slug: 'colecao/camisetas' }, []),
+      service.getPlpContent({ slug: 'outra' }, []),
+      service.getPlpContent({ slug: 'nao-existe' }, []),
+    ])
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(1)
+    expect(clientCP.getEntry).toHaveBeenCalledTimes(3)
+    expect(collectionPage.sections).toEqual([{ name: 'Collection' }])
+    expect(otherPage.sections).toEqual([{ name: 'Other' }])
+    expect(unknownPage.sections).toEqual([{ name: 'Generic' }])
+  })
+
+  it('reuses the cached list within the TTL', async () => {
+    const { service, clientCP } = createServiceWithClient()
+
+    await service.getPlpContent({ slug: 'colecao' }, [])
+    await service.getPlpContent({ slug: 'outra' }, [])
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(1)
+    expect(clientCP.getEntry).toHaveBeenCalledTimes(3)
+  })
+
+  it('still prefers a direct slug match over the cached list', async () => {
+    const { service, clientCP } = createServiceWithClient()
+    await service.getPlpContent({ slug: 'colecao' }, [])
+
+    clientCP.getEntryBySlug.mockResolvedValueOnce({
+      sections: [{ name: 'Direct' }],
+    })
+    const page = await service.getPlpContent({ slug: 'colecao' }, [])
+
+    expect(page.sections).toEqual([{ name: 'Direct' }])
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(1)
+  })
+
+  it('consumes every scroll page once', async () => {
+    const { service, clientCP } = createServiceWithClient([
+      ['generic'],
+      ['collection'],
+      ['other'],
+    ])
+
+    await Promise.all([
+      service.getMultipleContent({ contentType: 'plp' }),
+      service.getMultipleContent({ contentType: 'plp' }),
+    ])
+    const { data } = await service.getMultipleContent({ contentType: 'plp' })
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(3)
+    expect(clientCP.listEntries.mock.calls.map(([, scroll]) => scroll)).toEqual(
+      [undefined, '1', '2']
+    )
+    expect(data.map((entry) => entry.id)).toEqual([
+      'generic',
+      'collection',
+      'other',
+    ])
+  })
+
+  it('keeps separate entries per content type', async () => {
+    const { service, clientCP } = createServiceWithClient()
+
+    await service.getMultipleContent({ contentType: 'plp' })
+    await service.getMultipleContent({ contentType: 'pdp' })
+    await service.getMultipleContent({ contentType: 'pdp' })
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(2)
+    expect(
+      clientCP.listEntries.mock.calls.map(([params]) => params.contentType)
+    ).toEqual(['plp', 'pdp'])
+  })
+
+  it('bypasses the cache for previews', async () => {
+    const { service, clientCP } = createServiceWithClient()
+    const previewParams: ContentParams = {
+      contentType: 'plp',
+      previewData: {
+        contentType: 'plp',
+        documentId: 'collection',
+        versionId: 'version-1',
+      },
+    }
+
+    await service.getMultipleContent({ contentType: 'plp' })
+    await service.getMultipleContent(previewParams)
+    await service.getMultipleContent(previewParams)
+    await service.getMultipleContent({ contentType: 'plp' })
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(3)
+    expect(clientCP.getEntry).toHaveBeenCalledTimes(3)
+    expect(clientCP.previewEntryById).toHaveBeenCalledTimes(6)
+  })
+
+  it('does not cache failures', async () => {
+    const { service, clientCP } = createServiceWithClient()
+    const error = new Error('Request failed with status code 500')
+    clientCP.listEntries.mockRejectedValueOnce(error)
+
+    await expect(
+      service.getMultipleContent({ contentType: 'plp' })
+    ).rejects.toBe(error)
+    const { data } = await service.getMultipleContent({ contentType: 'plp' })
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(2)
+    expect(data).toHaveLength(3)
+  })
+
+  it('does not let a late failure evict a newer fetch', async () => {
+    jest.useFakeTimers()
+    const { service, clientCP } = createServiceWithClient()
+    let rejectFirst: (err: Error) => void = () => {}
+    clientCP.listEntries.mockImplementationOnce(
+      () =>
+        new Promise((_, reject) => {
+          rejectFirst = reject
+        })
+    )
+
+    const first = service.getMultipleContent({ contentType: 'plp' })
+    const firstResult = expect(first).rejects.toThrow('late failure')
+    jest.advanceTimersByTime(FIVE_MINUTES)
+    await service.getMultipleContent({ contentType: 'plp' })
+
+    rejectFirst(new Error('late failure'))
+    await firstResult
+    await service.getMultipleContent({ contentType: 'plp' })
+
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(2)
+  })
+
+  it('fetches the list again after the TTL', async () => {
+    jest.useFakeTimers()
+    const { service, clientCP } = createServiceWithClient()
+
+    await service.getMultipleContent({ contentType: 'plp' })
+    jest.advanceTimersByTime(FIVE_MINUTES - 1)
+    await service.getMultipleContent({ contentType: 'plp' })
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(1)
+
+    jest.advanceTimersByTime(1)
+    await service.getMultipleContent({ contentType: 'plp' })
+    expect(clientCP.listEntries).toHaveBeenCalledTimes(2)
+  })
+})