@faststore/core 3.99.3 → 3.99.6

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.99.2 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.99.2 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.99.2 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.99.2 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.99.2 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.99.2 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.99.2 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -86,8 +86,8 @@ Search not found. Add a new component for this section or remove it from the CMS
 
   Generating static pages (2/6) 
 Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
 Search not found. Add a new component for this section or remove it from the CMS
-
   Generating static pages (4/6) 
 Search not found. Add a new component for this section or remove it from the CMS
+
   Generating static pages (4/6) 
 Search not found. Add a new component for this section or remove it from the CMS
 
 ✓ Generating static pages (6/6) 
    Finalizing page optimization ...
@@ -112,7 +112,7 @@ Route (pages)                              Size     First Load JS
 ├ ● /login                                 1.7 kB          160 kB
 ├ λ /pvt/account                           247 B           109 kB
 ├ ● /pvt/account/[...unknown]              287 B           109 kB
-├ λ /pvt/account/403                       2.97 kB         161 kB
+├ λ /pvt/account/403                       3 kB            161 kB
 ├   └ css/6819dddf2b1b5ea7.css             4.84 kB
 ├ λ /pvt/account/404                       2.18 kB         160 kB
 ├   └ css/ea11d74a2848b093.css             4.89 kB
@@ -130,8 +130,8 @@ Route (pages)                              Size     First Load JS
 + First Load JS shared by all              118 kB
   ├ chunks/framework-d514426edf885c68.js   45.4 kB
   ├ chunks/main-ec03882c4375091d.js        33.2 kB
-  ├ chunks/pages/_app-84aaff8a9d4de60e.js  26.5 kB
-  ├ chunks/webpack-61b283a96fbb5ee2.js     3.89 kB
+  ├ chunks/pages/_app-35e8dda638ee2672.js  26.6 kB
+  ├ chunks/webpack-65b1de5f075b8367.js     3.89 kB
   └ css/146a8678babc61bf.css               9.2 kB
 
 λ  (Server)  server-side renders at runtime (uses getInitialProps or getServerSideProps)

package/.turbo/turbo-test.log

@@ -1,17 +1,19 @@
 
-> @faststore/core@3.99.2 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.4 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/clearCookies.test.ts (11.209 s)
-PASS test/utils/multipleTemplates.test.ts (12.971 s)
+PASS test/utils/multipleTemplates.test.ts (11.618 s)
+PASS test/utils/clearCookies.test.ts (12.194 s)
+PASS test/utils/cookieCacheBusting.test.ts (13.633 s)
 PASS test/server/cms/global.test.ts
 PASS test/utils/validateSessionRefreshToken.test.ts
-PASS test/utils/cookieCacheBusting.test.ts (14.113 s)
-PASS test/server/cms/index.test.ts (5.539 s)
-PASS test/server/index.test.ts (12.817 s)
+PASS test/utils/isLocalHost.test.ts
+PASS test/utils/isLocalHost.browser.test.ts
+PASS test/server/cms/index.test.ts (6.005 s)
+PASS test/server/index.test.ts (13.099 s)
 
-Test Suites: 7 passed, 7 total
-Tests:       58 passed, 58 total
+Test Suites: 9 passed, 9 total
+Tests:       68 passed, 68 total
 Snapshots:   0 total
-Time:        26.435 s
+Time:        25.905 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.99.6](https://github.com/vtex/faststore/compare/v3.99.5...v3.99.6) (2026-05-19)
+
+### Bug Fixes
+
+- bypass refresh-token flow on localhost in 403 page and useRefreshToken hook ([#3326](https://github.com/vtex/faststore/issues/3326)) ([5943129](https://github.com/vtex/faststore/commit/5943129ed4aa51823e90b7826a88a864f75ddd11)), closes [#3325](https://github.com/vtex/faststore/issues/3325) [#3325](https://github.com/vtex/faststore/issues/3325)
+
+## 3.99.4 (2026-05-14)
+
+### Bug Fixes
+
+- region slider section render 3.x ([#3321](https://github.com/vtex/faststore/issues/3321)) ([8e9fa4f](https://github.com/vtex/faststore/commit/8e9fa4fae7d6c306e66164e3229d2f74b28982d3))
+- use starter.store 3.x branch in CI ([#3324](https://github.com/vtex/faststore/issues/3324)) ([baaf13c](https://github.com/vtex/faststore/commit/baaf13cc791b7c54948f31fe2891ea3351706053)), closes [#3321](https://github.com/vtex/faststore/issues/3321) [#3321](https://github.com/vtex/faststore/issues/3321)
+
 ## [3.99.3](https://github.com/vtex/faststore/compare/v3.99.2...v3.99.3) (2026-05-12)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.99.3",
+  "version": "3.99.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -51,11 +51,11 @@
     "@envelop/graphql-jit": "^8.0.3",
     "@envelop/parser-cache": "^6.0.2",
     "@envelop/validation-cache": "^6.0.2",
-    "@faststore/api": "3.99.1",
-    "@faststore/graphql-utils": "^3.99.1",
-    "@faststore/lighthouse": "3.99.1",
-    "@faststore/sdk": "3.99.2",
-    "@faststore/ui": "3.99.2",
+    "@faststore/api": "3.99.4",
+    "@faststore/graphql-utils": "^3.99.4",
+    "@faststore/lighthouse": "3.99.4",
+    "@faststore/sdk": "3.99.4",
+    "@faststore/ui": "3.99.4",
     "@graphql-codegen/cli": "5.0.2",
     "@graphql-codegen/client-preset": "4.2.6",
     "@graphql-codegen/typescript": "4.0.7",
@@ -126,5 +126,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "9246edbaf5fc09d779d11b17d357a07860f67d26"
+  "gitHead": "5636f4f2af5ef09cc522c45364d85d445ca5c716"
 }

package/src/components/cms/RenderSections.tsx

@@ -23,7 +23,37 @@ interface Props {
   isInteractive?: boolean
 }
 
-const SECTIONS_OUT_OF_VIEWPORT = ['CartSidebar', 'RegionModal', 'RegionSlider']
+const REGION_SLIDER_SECTION_NAME = 'RegionSlider'
+
+const SECTIONS_OUT_OF_VIEWPORT = [
+  'CartSidebar',
+  'RegionModal',
+  REGION_SLIDER_SECTION_NAME,
+]
+
+/**
+ * Ensure a RegionSlider section exists in the iteration. After PR #2961 the
+ * section was removed from `sections.json`, so CP-based stores (whose CP
+ * schemas were generated in PR #3071) and fresh hCMS stores no longer have it
+ * in their CMS content. The runtime still expects the section to flow through
+ * `RenderSections` so that `LazyLoadingSection` can gate the lazy import on
+ * `regionSlider.isOpen`. Inject the entry only if it is not already present in
+ * `sections` or `globalSections` to avoid double-rendering for legacy hCMS
+ * stores that have it persisted in their CMS.
+ */
+function withRegionSliderSection(
+  sections: Section[] | undefined,
+  globalSections: Section[] | undefined
+): Section[] {
+  const base = sections ?? []
+  const isPresent =
+    base.some(({ name }) => name === REGION_SLIDER_SECTION_NAME) ||
+    globalSections?.some(({ name }) => name === REGION_SLIDER_SECTION_NAME)
+
+  if (isPresent) return base
+
+  return [...base, { name: REGION_SLIDER_SECTION_NAME, data: {} }]
+}
 
 const Toast = dynamic(
   () => import(/* webpackChunkName: "Toast" */ '../common/Toast'),
@@ -148,6 +178,11 @@ function RenderSections({
     globalSections ?? sections
   )
 
+  const augmentedSections = useMemo(
+    () => withRegionSliderSection(sections, globalSections),
+    [sections, globalSections]
+  )
+
   const { isInteractive } = useTTI()
   const router = useRouter()
 
@@ -170,9 +205,9 @@ function RenderSections({
           isInteractive={isInteractive}
         />
       )}
-      {sections && sections.length > 0 && (
+      {augmentedSections.length > 0 && (
         <RenderSectionsBase
-          sections={sections}
+          sections={augmentedSections}
           components={components}
           isInteractive={isInteractive}
         />

package/src/pages/api/graphql.ts

@@ -9,6 +9,7 @@ import type { NextApiHandler, NextApiRequest } from 'next'
 
 import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
+import { isLocalHost } from 'src/utils/isLocalHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 
@@ -161,8 +162,7 @@ const handler: NextApiHandler = async (request, response) => {
     // value is used to cache bust the request if there is a VtexIdclientAutCookie
     const { operation, variables, query, v: value } = parseRequest(request)
 
-    const hostname = request.headers.host?.split(':')[0]
-    const isLocal = hostname === 'localhost' || hostname === '127.0.0.1'
+    const isLocal = isLocalHost(request.headers.host?.split(':')[0])
 
     if (
       !isLocal &&

package/src/pages/pvt/account/403.tsx

@@ -23,6 +23,7 @@ import { useRefreshToken } from 'src/sdk/account/useRefreshToken'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
+import { isLocalHost } from 'src/utils/isLocalHost'
 import { getMyAccountRedirect } from 'src/utils/myAccountRedirect'
 
 import storeConfig from 'discovery.config'
@@ -132,10 +133,18 @@ export const getServerSideProps: GetServerSideProps<
     const fromPage =
       typeof context.query.from === 'string' ? context.query.from : ''
 
+    // The refresh-token round-trip is unreachable from localhost (cross-origin
+    // POST that drops the `vid_rt` cookie), and forcing it would clear the
+    // manually injected `VtexIdclientAutCookie_<account>`. Render the static
+    // 403 view instead so developers can keep testing logged-in scenarios
+    // regardless of the `experimental.refreshToken` flag.
+    const isLocal = isLocalHost(context.req.headers.host?.split(':')[0])
+
     return {
       props: {
         globalSections: globalSectionsResult,
         needsRefreshToken:
+          !isLocal &&
           (statusCode === 401 || statusCode === 403) &&
           storeConfig.experimental?.refreshToken,
         fromPage,

package/src/sdk/account/useRefreshToken.ts

@@ -1,4 +1,5 @@
 import { useEffect, useState } from 'react'
+import { isLocalHostBrowser } from 'src/utils/isLocalHost'
 import { logoutAndClearSession, sessionStore } from '../session'
 import { isRefreshTokenSuccessful, refreshTokenRequest } from './refreshToken'
 
@@ -12,6 +13,17 @@ export const useRefreshToken = (
     const handleRefreshTokenAndUpdateSession = async () => {
       if (!needsRefreshToken) return
 
+      // The refresh-token endpoint lives on the production origin and relies on
+      // the `vid_rt` cookie scoped to that origin. From localhost the request is
+      // cross-origin, so the cookie is not sent and the refresh always fails —
+      // which would also wipe the manually injected `VtexIdclientAutCookie_<account>`
+      // via `logoutAndClearSession`. Bail out and fall back to the static 403
+      // view so developers can keep testing logged-in flows.
+      if (isLocalHostBrowser()) {
+        setShouldShow403(true)
+        return
+      }
+
       const currentSession = sessionStore.read() ?? sessionStore.readInitial()
 
       try {

package/src/sdk/session/index.ts

@@ -8,6 +8,7 @@ import type {
   ValidateSessionMutationVariables,
 } from '@generated/graphql'
 import deepEqual from 'fast-deep-equal'
+import { isLocalHostBrowser } from 'src/utils/isLocalHost'
 import storeConfig from '../../../discovery.config'
 import {
   isRefreshTokenSuccessful,
@@ -19,11 +20,6 @@ import { createValidationStore, useStore } from '../useStore'
 import { getPostalCode } from '../userLocation/index'
 import { RELOAD_AFTER_LOGOUT_KEY, SESSION_READY_KEY } from './storageKeys'
 
-const isLocalEnvironment = (): boolean =>
-  typeof window !== 'undefined' &&
-  (window.location.hostname === 'localhost' ||
-    window.location.hostname === '127.0.0.1')
-
 const isReloadAfterLogoutPending = (): boolean => {
   try {
     return (
@@ -127,7 +123,7 @@ export const validateSession = async (session: Session) => {
   // On failure (logoutAndClearSession already triggered), bail out.
   // Skipped in local environments where the refresh token infrastructure is unavailable.
   if (
-    !isLocalEnvironment() &&
+    !isLocalHostBrowser() &&
     storeConfig.experimental?.refreshToken &&
     isRefreshAfterExpired(session)
   ) {
@@ -180,7 +176,7 @@ export const validateSession = async (session: Session) => {
     return data.validateSession
   } catch (error) {
     const shouldRefreshToken =
-      !isLocalEnvironment() &&
+      !isLocalHostBrowser() &&
       error?.status === 401 &&
       storeConfig.experimental?.refreshToken
 

package/src/utils/isLocalHost.ts

@@ -0,0 +1,33 @@
+/**
+ * Hostnames that represent a local development environment.
+ *
+ * These are the only hosts where the FastStore app skips the refresh-token
+ * flow so developers can drive the app with a manually injected
+ * `VtexIdclientAutCookie_<account>` cookie regardless of feature flags.
+ */
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1'])
+
+/**
+ * Returns `true` when the given hostname corresponds to a local development
+ * environment (`localhost` / `127.0.0.1`).
+ *
+ * Refresh-token and other production-only flows MUST be bypassed on these
+ * hostnames so that developers can test logged-in scenarios with manually
+ * injected cookies, independent of any experimental flag.
+ *
+ * The input MUST be a bare hostname (no port). Callers should strip the port
+ * (e.g. `host.split(':')[0]`) before invoking this helper.
+ */
+export function isLocalHost(hostname: string | null | undefined): boolean {
+  if (!hostname) return false
+  return LOCAL_HOSTNAMES.has(hostname.toLowerCase())
+}
+
+/**
+ * Browser-side wrapper that reads `window.location.hostname`. Returns `false`
+ * when `window` is not available (SSR/Node).
+ */
+export function isLocalHostBrowser(): boolean {
+  if (typeof window === 'undefined') return false
+  return isLocalHost(window.location.hostname)
+}

package/test/utils/isLocalHost.browser.test.ts

@@ -0,0 +1,40 @@
+/**
+ * @jest-environment jsdom
+ */
+
+import { isLocalHostBrowser } from '../../src/utils/isLocalHost'
+
+const originalLocation = window.location
+
+function stubHostname(hostname: string) {
+  // jsdom forbids assigning to `window.location` directly, so we redefine the
+  // descriptor with a minimal stub that exposes the hostname we want to test.
+  Object.defineProperty(window, 'location', {
+    configurable: true,
+    value: { ...originalLocation, hostname },
+  })
+}
+
+describe('isLocalHostBrowser', () => {
+  afterEach(() => {
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it('returns true when window.location.hostname is "localhost"', () => {
+    stubHostname('localhost')
+    expect(isLocalHostBrowser()).toBe(true)
+  })
+
+  it('returns true when window.location.hostname is "127.0.0.1"', () => {
+    stubHostname('127.0.0.1')
+    expect(isLocalHostBrowser()).toBe(true)
+  })
+
+  it('returns false for a production hostname', () => {
+    stubHostname('brandless.fast.store')
+    expect(isLocalHostBrowser()).toBe(false)
+  })
+})

package/test/utils/isLocalHost.test.ts

@@ -0,0 +1,38 @@
+import { isLocalHost } from '../../src/utils/isLocalHost'
+
+describe('isLocalHost', () => {
+  it('returns true for "localhost"', () => {
+    expect(isLocalHost('localhost')).toBe(true)
+  })
+
+  it('returns true for "127.0.0.1"', () => {
+    expect(isLocalHost('127.0.0.1')).toBe(true)
+  })
+
+  it('is case-insensitive', () => {
+    expect(isLocalHost('LOCALHOST')).toBe(true)
+    expect(isLocalHost('Localhost')).toBe(true)
+  })
+
+  it('returns false for a production hostname', () => {
+    expect(isLocalHost('brandless.fast.store')).toBe(false)
+  })
+
+  it('returns false for IPv6 loopback (not in the bypass list)', () => {
+    // We intentionally bypass only the two canonical local hosts. IPv6
+    // loopback (`::1`) and other loopback variants are out of scope.
+    expect(isLocalHost('::1')).toBe(false)
+  })
+
+  it('returns false for inputs that still carry a port', () => {
+    // Callers MUST normalize the hostname (strip the port) before invoking
+    // this helper.
+    expect(isLocalHost('localhost:3000')).toBe(false)
+  })
+
+  it('returns false for null/undefined/empty input', () => {
+    expect(isLocalHost(null)).toBe(false)
+    expect(isLocalHost(undefined)).toBe(false)
+    expect(isLocalHost('')).toBe(false)
+  })
+})