@faststore/core 4.10.1 → 4.10.2-dev.0

package/src/pages/pvt/account/quotes/index.tsx

@@ -27,7 +27,7 @@ import BeforeSection from 'src/customizations/src/myAccount/extensions/quotes/be
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountQuotesPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -56,7 +56,7 @@ export default function ListQuotesPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListQuotesPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -73,7 +73,7 @@ export default function ListQuotesPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -122,7 +122,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -273,7 +273,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/security.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountSecurityPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -51,7 +51,7 @@ export default function Page({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: SecurityPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function Page({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -101,7 +101,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -185,7 +185,7 @@ const getServerSidePropsBase: GetServerSideProps<
       },
       globalSections: globalSectionsResult,
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/user-details.tsx

@@ -23,7 +23,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountUserDetailsPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -50,7 +50,7 @@ export default function Page({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: UserDetailsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -67,7 +67,7 @@ export default function Page({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -105,7 +105,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -118,7 +118,7 @@ const getServerSidePropsBase: GetServerSideProps<
     return { redirect }
   }
 
-  if (!isRepresentative) {
+  if (!isB2BBuyer) {
     return {
       redirect: {
         destination: localizeRedirectDestination('/pvt/account', context),
@@ -209,7 +209,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/sdk/account/getB2BSessionClaims.ts

@@ -10,7 +10,7 @@ export type B2BSessionClaims = {
   /**
    * Whether the buyer is associated with a Unit/Contract. Per the Personal
    * Cards PRD (REQ-2), this is detected by the presence of a `unitId` claim in
-   * the VTEX ID JWT — the same cookie `getIsRepresentative` already decodes.
+   * the VTEX ID JWT — the same cookie `getIsB2BBuyer` already decodes.
    * Gates the Shared tab (FR-5).
    *
    * Note this is the only part of the gate that lives in the token. The

package/src/sdk/account/getIsB2BBuyer.ts

@@ -0,0 +1,28 @@
+import { parse } from 'cookie'
+import { parseJwt } from 'src/utils/getCookie'
+
+type GetIsB2BBuyerParams = {
+  headers?: Record<string, string>
+  account: string
+}
+
+/**
+ * Whether the buyer is a B2B member: the VTEX ID token carries both an
+ * organizational unit and a contract, the rule Buyer Portal uses. The
+ * `isRepresentative` claim is not read, since it can be true outside B2B.
+ */
+export function getIsB2BBuyer({
+  headers,
+  account,
+}: GetIsB2BBuyerParams): boolean {
+  const authCookie = parse(headers?.cookie ?? '')?.[
+    'VtexIdclientAutCookie_' + account
+  ]
+  const jwt = parseJwt(authCookie)
+
+  return isNonBlankString(jwt?.unitId) && isNonBlankString(jwt?.customerId)
+}
+
+function isNonBlankString(value: unknown): boolean {
+  return typeof value === 'string' && value.trim() !== ''
+}

package/src/sdk/account/refreshToken.ts

@@ -1,10 +1,21 @@
 import fetch from 'isomorphic-unfetch'
 import { getStoreURL } from 'src/sdk/localization/useLocalizationConfig'
 import { sanitizeHost } from 'src/utils/utilities'
+import {
+  AUTHENTICATOR_REFRESH_TOKEN_PATH,
+  LEGACY_REFRESH_TOKEN_PATH,
+} from './refreshTokenPaths'
 
+/**
+ * Covers both refresh routes:
+ * - Authenticator: `{ authStatus: 'Success', refreshAfter: 1792717383 }`
+ *   (epoch seconds).
+ * - Legacy VTEX ID: `{ status: 'Success', refreshAfter: '2026-03-26T02:53:39+00:00' }`.
+ */
 export interface RefreshTokenResponse {
   status?: string
-  refreshAfter?: string
+  authStatus?: string
+  refreshAfter?: string | number
 }
 
 async function fetchWithRetry(
@@ -25,12 +36,12 @@ async function fetchWithRetry(
   return undefined
 }
 
-function getRefreshTokenUrl(): string {
+function getRefreshTokenUrl(path: string): string {
   if (globalThis.window !== undefined) {
-    return '/api/vtexid/refreshtoken/webstore'
+    return path
   }
 
-  return `${new URL(getStoreURL()).origin}/api/vtexid/refreshtoken/webstore`
+  return `${new URL(getStoreURL()).origin}${path}`
 }
 
 function getRefreshTokenHeaders(): HeadersInit {
@@ -45,10 +56,43 @@ function getRefreshTokenHeaders(): HeadersInit {
   return headers
 }
 
-export const refreshTokenRequest = async (): Promise<
-  RefreshTokenResponse | undefined
-> => {
-  return fetchWithRetry(getRefreshTokenUrl(), {
+export const isRefreshTokenSuccessful = (
+  result: RefreshTokenResponse | undefined
+): boolean => {
+  return (result?.authStatus ?? result?.status)?.toLowerCase?.() === 'success'
+}
+
+/**
+ * Whether the session belongs to a B2B buyer: one with an organizational unit
+ * (`unitId`) and a contract (`customerId`), the same rule the API uses to
+ * fill `session.b2b`.
+ */
+export const isB2BSession = (
+  session:
+    | {
+        b2b?: {
+          unitId?: string | null
+          customerId?: string | null
+        } | null
+      }
+    | null
+    | undefined
+): boolean => Boolean(session?.b2b?.unitId && session?.b2b?.customerId)
+
+/**
+ * Refresh route for the session. B2B sessions use the Authenticator route,
+ * which keeps the selected contract (`customerId`, `unitId`,
+ * `isRepresentative`). Every other session keeps the legacy VTEX ID route, as
+ * VTEX ID recommends. There is no fallback between them: like before, a failed
+ * refresh logs the shopper out.
+ */
+export const getRefreshTokenPath = (isB2B: boolean): string =>
+  isB2B ? AUTHENTICATOR_REFRESH_TOKEN_PATH : LEGACY_REFRESH_TOKEN_PATH
+
+export const refreshTokenRequest = async ({
+  isB2B = false,
+}: { isB2B?: boolean } = {}): Promise<RefreshTokenResponse | undefined> => {
+  return fetchWithRetry(getRefreshTokenUrl(getRefreshTokenPath(isB2B)), {
     credentials: 'include',
     headers: getRefreshTokenHeaders(),
     body: JSON.stringify({}),
@@ -56,8 +100,42 @@ export const refreshTokenRequest = async (): Promise<
   })
 }
 
-export const isRefreshTokenSuccessful = (
+/**
+ * Normalizes `refreshAfter` to epoch seconds as a string, the format stored in
+ * the session. Accepts epoch seconds (number or numeric string) and ISO dates.
+ * Returns `null` when the value is missing or unparseable.
+ */
+export const getRefreshAfterSeconds = (
   result: RefreshTokenResponse | undefined
-): boolean => {
-  return result?.status?.toLowerCase?.() === 'success'
+): string | null => {
+  const value = result?.refreshAfter
+
+  if (value === undefined || value === null || value === '') {
+    return null
+  }
+
+  const seconds =
+    typeof value === 'number' || /^\d+$/.test(value)
+      ? Number(value)
+      : new Date(value).getTime() / 1000
+
+  return Number.isFinite(seconds) ? String(Math.floor(seconds)) : null
 }
+
+/**
+ * How long to wait before refreshing again when a successful refresh carries
+ * no usable `refreshAfter`. Keeping the old, already-expired value would make
+ * every following session validation call the refresh route again.
+ */
+export const REFRESH_AFTER_FALLBACK_SECONDS = 60 * 60
+
+/**
+ * `refreshAfter` to store after a successful refresh: the value from the
+ * response, or a short fallback from now when the response has none.
+ */
+export const getNextRefreshAfter = (
+  result: RefreshTokenResponse | undefined,
+  nowSeconds = Math.floor(Date.now() / 1000)
+): string =>
+  getRefreshAfterSeconds(result) ??
+  String(nowSeconds + REFRESH_AFTER_FALLBACK_SECONDS)

package/src/sdk/account/refreshTokenPaths.ts

@@ -0,0 +1,25 @@
+/**
+ * VTEX ID refresh route. The recommended route for every non-B2B session.
+ * For B2B it drops the contract claims set by `switch-properties` and also
+ * writes the auth cookie on the parent domain.
+ */
+export const LEGACY_REFRESH_TOKEN_PATH = '/api/vtexid/refreshtoken/webstore'
+
+/**
+ * Authenticator refresh route, recommended for the B2B flow only. It keeps the
+ * contract claims (`customerId`, `unitId`, `isRepresentative`) and writes the
+ * auth cookie only on the request host.
+ */
+export const AUTHENTICATOR_REFRESH_TOKEN_PATH =
+  '/api/authenticator/v1/refreshtoken/webstore'
+
+/**
+ * Every path `vid_rt` can be scoped to. VTEX ID writes it only on the legacy
+ * path; Authenticator writes it on all three. The browser only sends it to
+ * these paths, so it never reaches any other route.
+ */
+export const VID_RT_PATHS = [
+  LEGACY_REFRESH_TOKEN_PATH,
+  '/api/authenticator/refreshtoken/webstore',
+  AUTHENTICATOR_REFRESH_TOKEN_PATH,
+] as const

package/src/sdk/account/useRefreshToken.ts

@@ -1,7 +1,12 @@
 import { useEffect, useState } from 'react'
-import { isLocalHostBrowser } from 'src/utils/isLocalHost'
+import { shouldBypassRefreshTokenBrowser } from 'src/utils/shouldBypassRefreshToken'
 import { logoutAndClearSession, sessionStore } from '../session'
-import { isRefreshTokenSuccessful, refreshTokenRequest } from './refreshToken'
+import {
+  getNextRefreshAfter,
+  isB2BSession,
+  isRefreshTokenSuccessful,
+  refreshTokenRequest,
+} from './refreshToken'
 
 export const useRefreshToken = (
   needsRefreshToken?: boolean,
@@ -13,13 +18,12 @@ export const useRefreshToken = (
     const handleRefreshTokenAndUpdateSession = async () => {
       if (!needsRefreshToken) return
 
-      // The refresh-token endpoint lives on the production origin and relies on
-      // the `vid_rt` cookie scoped to that origin. From localhost the request is
-      // cross-origin, so the cookie is not sent and the refresh always fails —
-      // which would also wipe the manually injected `VtexIdclientAutCookie_<account>`
+      // The refresh-token endpoint relies on VTEX ID, which neither localhost
+      // nor WebOps previews proxy, so the refresh always fails there — which
+      // would also wipe the manually injected `VtexIdclientAutCookie_<account>`
       // via `logoutAndClearSession`. Bail out and fall back to the static 403
       // view so developers can keep testing logged-in flows.
-      if (isLocalHostBrowser()) {
+      if (shouldBypassRefreshTokenBrowser()) {
         setShouldShow403(true)
         return
       }
@@ -27,13 +31,13 @@ export const useRefreshToken = (
       const currentSession = sessionStore.read() ?? sessionStore.readInitial()
 
       try {
-        const result = await refreshTokenRequest()
+        const result = await refreshTokenRequest({
+          isB2B: isB2BSession(currentSession),
+        })
 
         if (isRefreshTokenSuccessful(result)) {
           // Update session with new refreshAfter timestamp
-          const refreshAfter = String(
-            Math.floor(new Date(result?.refreshAfter).getTime() / 1000)
-          )
+          const refreshAfter = getNextRefreshAfter(result)
 
           sessionStore.set({
             ...currentSession,

package/src/sdk/product/isProductNotFound.ts

@@ -0,0 +1,13 @@
+/**
+ * Whether a product request failed because the product is not available to
+ * the shopper. A non-2xx BFF response reaches the client as `{ status }` (see
+ * `ParseInvalidRequest`), while a 2xx one keeps the GraphQL `extensions`.
+ */
+export const isProductNotFound = (error: unknown) => {
+  const { status, extensions } = (error ?? {}) as {
+    status?: number
+    extensions?: { type?: string }
+  }
+
+  return status === 404 || extensions?.type === 'NotFoundError'
+}

package/src/sdk/product/usePageProductsQuery.ts

@@ -69,6 +69,69 @@ export const query = gql(`
 
 const getKey = (object: any) => JSON.stringify(object)
 
+const isDeliveryPromiseEnabled = storeConfig.deliveryPromise?.enabled ?? false
+
+/**
+ * Cache-only keys that scope gallery pages to the shopper context. They make
+ * the local cache comparison (and the SWR key) miss when a page was loaded for
+ * another context (e.g. the anonymous SSG page). They are not declared by the
+ * operation, so the API ignores them, but they are still sent with the
+ * variables, which go in the URL because this query is a GET operation.
+ * - `_postalCode`: pages are invalidated on region change. Only applied when
+ *   deliveryPromise is enabled to avoid unnecessary cache fragmentation.
+ * - `_contract`: the B2B contract assortment is applied server-side from the
+ *   session cookie, so it never shows up in the query variables. Keyed off
+ *   the presence of a `b2b` session (not `customerId`'s value) because
+ *   `customerId` can resolve to an empty string for a legitimate B2B buyer
+ *   (see `buildB2bSession` in `@faststore/api`). The fallback chain still
+ *   forces the re-fetch for them: the real `customerId`, when present, keeps
+ *   invalidating the cache on contract switch; otherwise the organizational
+ *   unit (`unitId`) tells buyers of different units apart; a generic marker is
+ *   the last resort. Since the value ends up in the URL, it is hashed so the
+ *   raw contract or unit id is not written to access, CDN or RUM logs as is.
+ *   These ids are not secrets (the session already hands them to the
+ *   browser), so the hash is cosmetic, not a privacy control: it is unkeyed
+ *   and a guessable id can be recovered from it. The URL still differs per
+ *   contract, so a contract page is never served from the anonymous page's
+ *   cache entry.
+ */
+const getShopperScope = ({
+  postalCode,
+  contract,
+}: {
+  postalCode?: string | null
+  contract?: string | null
+}) => ({
+  ...(isDeliveryPromiseEnabled && { _postalCode: postalCode ?? '' }),
+  ...(contract && { _contract: hashContractScope(contract) }),
+})
+
+/** The id a B2B session is scoped by, or `null` outside a B2B session. */
+const getContractScope = (
+  b2b?: { customerId?: string | null; unitId?: string | null } | null
+) => (b2b ? b2b.customerId || b2b.unitId || 'b2b' : null)
+
+/**
+ * 53-bit string hash (cyrb53): wide enough that two contracts in the same
+ * browser never share a cache key in practice, without exposing the raw id.
+ */
+export function hashContractScope(value: string) {
+  let h1 = 0xdeadbeef
+  let h2 = 0x41c6ce57
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0
+    h1 = Math.imul(h1 ^ code, 2654435761)
+    h2 = Math.imul(h2 ^ code, 1597334677)
+  }
+  h1 =
+    Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^
+    Math.imul(h2 ^ (h2 >>> 13), 3266489909)
+  h2 =
+    Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^
+    Math.imul(h1 ^ (h1 >>> 13), 3266489909)
+  return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36)
+}
+
 interface UseCreateUseGalleryPageProps {
   initialPages: ClientManyProductsQueryWithSearchIdQuery
   serverManyProductsVariables: ClientManyProductsQueryWithSearchIdQueryVariables
@@ -82,21 +145,17 @@ export const useCreateUseGalleryPage = (
 ) => {
   const initialPages = params?.initialPages?.search ? [params.initialPages] : []
 
-  // Seed the cache with the same region-aware key shape that useGalleryPage uses,
-  // so hasSameVariables correctly matches on first mount and avoids an unnecessary
-  // re-fetch of the SSR-loaded page.
-  const isDeliveryPromiseEnabled = storeConfig.deliveryPromise?.enabled ?? false
+  // Seed the cache with the same key shape that useGalleryPage uses, so
+  // hasSameVariables matches on first mount and avoids an unnecessary re-fetch
+  // of the SSR-loaded page. The SSG page is built without a buyer, so it is
+  // seeded without a contract: B2B buyers re-fetch it with their assortment.
   const { postalCode } = useSession()
   const initialVariables = params?.serverManyProductsVariables
     ? [
-        getKey(
-          isDeliveryPromiseEnabled
-            ? {
-                ...params.serverManyProductsVariables,
-                _postalCode: postalCode ?? '',
-              }
-            : params.serverManyProductsVariables
-        ),
+        getKey({
+          ...params.serverManyProductsVariables,
+          ...getShopperScope({ postalCode }),
+        }),
       ]
     : []
 
@@ -113,7 +172,7 @@ export const useCreateUseGalleryPage = (
       itemsPerPage,
     } = useSearch()
 
-    const { postalCode, isValidating: isSessionValidating } = useSession()
+    const { postalCode, b2b, isValidating: isSessionValidating } = useSession()
 
     const localizedVariables = useLocalizedVariables({
       first: itemsPerPage,
@@ -123,15 +182,15 @@ export const useCreateUseGalleryPage = (
       selectedFacets,
     })
 
-    // Include postalCode in the cache key so pages are invalidated on region change.
-    // _postalCode is not sent to the API — it only affects the local cache comparison.
-    // Only applied when deliveryPromise is enabled to avoid unnecessary cache fragmentation.
+    // Keyed on the contract id, not the `b2b` object, which is rebuilt on
+    // every session update.
+    const contract = getContractScope(b2b)
     const localizedVariablesWithRegion = useMemo(
-      () =>
-        isDeliveryPromiseEnabled
-          ? { ...localizedVariables, _postalCode: postalCode ?? '' }
-          : localizedVariables,
-      [localizedVariables, postalCode]
+      () => ({
+        ...localizedVariables,
+        ...getShopperScope({ postalCode, contract }),
+      }),
+      [localizedVariables, postalCode, contract]
     )
 
     const hasSameVariables = deepEquals(

package/src/sdk/product/useProductNotFoundRedirect.ts

@@ -0,0 +1,43 @@
+import { useRouter } from 'next/router'
+import { useEffect, useRef } from 'react'
+
+import { isProductNotFound } from './isProductNotFound'
+
+/**
+ * The PDP is statically generated without the shopper's session, so an
+ * assortment restriction (e.g. a B2B contract limited to a collection) is only
+ * enforced when the client refetches the product. Replaces the PDP with the
+ * store's 404 page when that refetch says the product is not available to the
+ * shopper. The URL becomes `/404`: passing the product path as the `as`
+ * argument would make Next load the PDP's data for the 404 page, which expects
+ * a different shape and crashes.
+ *
+ * Applies to every shopper: the API rejects the product from the
+ * `vtex_segment` assortment, the same rule Intelligent Search applies to
+ * listings, whether or not the session is B2B.
+ *
+ * Returns whether the PDP must keep its loading state instead of the product's
+ * price and buy button while the redirect is pending. Without it, the failed
+ * refetch falls back to the static product and its price shows until the 404
+ * page loads.
+ */
+export const useProductNotFoundRedirect = (error: unknown) => {
+  const router = useRouter()
+  const shouldRedirect = isProductNotFound(error)
+  // The router changes identity on route events, which re-runs the effect.
+  // Navigate once per not-found so a pending redirect is not restarted.
+  const hasRedirected = useRef(false)
+
+  useEffect(() => {
+    if (!shouldRedirect) {
+      hasRedirected.current = false
+      return
+    }
+    if (hasRedirected.current) return
+
+    hasRedirected.current = true
+    router.replace('/404')
+  }, [shouldRedirect, router])
+
+  return shouldRedirect
+}

package/src/sdk/product/useProductQuery.ts

@@ -6,8 +6,11 @@ import type {
   ClientProductQueryQueryVariables,
 } from '@generated/graphql'
 
+import { request } from '../graphql/request'
+import { onErrorRetry } from '../graphql/retryPolicy'
 import { useQuery } from '../graphql/useQuery'
 import { useSession } from '../session'
+import { isProductNotFound } from './isProductNotFound'
 
 const query = gql(`
   query ClientProductQuery($locator: [IStoreSelectedFacet!]!) {
@@ -18,6 +21,19 @@ const query = gql(`
   }
 `)
 
+const nextTick = () => new Promise<void>((resolve) => setTimeout(resolve))
+
+const fetchProduct = async <T extends ClientProductQueryQuery>(
+  variables: ClientProductQueryQueryVariables
+) => {
+  await nextTick()
+
+  return (await request<
+    ClientProductQueryQuery & T,
+    ClientProductQueryQueryVariables
+  >(query, variables)) as ClientProductQueryQuery & T
+}
+
 export const useProductQuery = <T extends ClientProductQueryQuery>(
   productID: string,
   fallbackData?: T
@@ -45,5 +61,18 @@ export const useProductQuery = <T extends ClientProductQueryQuery>(
   >(query, variables, {
     fallbackData,
     revalidateOnMount: true,
+    // `useQuery`'s default fetcher never settles when `request` throws, so SWR
+    // never exposes `error` (e.g. the B2B assortment 404 the PDP reacts to).
+    // This fetcher keeps the same deferral but forwards the rejection.
+    fetcher: () => fetchProduct<T>(variables),
+    // A not-found is the answer (the product is not available to this
+    // shopper), not a transient failure, so it is not retried. It is matched
+    // the same way the PDP redirect matches it. Other errors follow the shared
+    // retry policy.
+    onErrorRetry: (error, key, config, revalidate, opts) => {
+      if (isProductNotFound(error)) return
+
+      onErrorRetry(error, key, config, revalidate, opts)
+    },
   })
 }