@faststore/core 4.9.3-dev.0 → 4.9.3-dev.2

package/.turbo/turbo-generate.log

@@ -1,9 +1,9 @@
 
-> @faststore/core@4.9.2 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 generate /home/runner/work/faststore/faststore/packages/core
 > pnpm run gen-types && pnpm run cache-graphql 
 
 
-> @faststore/core@4.9.2 gen-types /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 gen-types /home/runner/work/faststore/faststore/packages/core
 > node ../cli/bin/run generate-types .
 
 [STARTED] Parse Configuration
@@ -19,7 +19,7 @@
 [COMPLETED] Generate to @generated/
 [COMPLETED] Generate outputs
 
-> @faststore/core@4.9.2 cache-graphql /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 cache-graphql /home/runner/work/faststore/faststore/packages/core
 > node ../cli/bin/run cache-graphql --config=./discovery.config.default.js --queries=./@generated/persisted-documents.json
 
 [Info] - Config file location: /home/runner/work/faststore/faststore/packages/core/discovery.config.default.js

package/.turbo/turbo-test.log

@@ -1,5 +1,5 @@
 
-> @faststore/core@4.9.2 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 test /home/runner/work/faststore/faststore/packages/core
 > vitest run
 
 
@@ -7,23 +7,27 @@
 
 Not implemented: navigation to another Document
 Not implemented: navigation to another Document
- ✓  browser  test/sdk/ui/useScrollRestoration.browser.test.ts (43 tests) 1025ms
 Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
- ✓  browser  test/components/account/cards/MyAccountListCards.browser.test.tsx (16 tests) 2299ms
-     ✓ shows the tab bar and renders Personal cards by default  888ms
-     ✓ paginates when there are more than 25 cards  355ms
- ✓  browser  test/components/account/ContractSwitcher.browser.test.tsx (22 tests) 2772ms
-     ✓ shows an error state when the list fails to load  455ms
- ✓  browser  test/components/account/orders/BuyingPolicyAlert.browser.test.tsx (13 tests) 2283ms
-     ✓ opens the reject confirmation modal with the default English copy  1093ms
- ✓  browser  test/components/account/OrganizationDrawer.browser.test.tsx (10 tests) 1261ms
-     ✓ renders the menu view with contract details and manage footer  697ms
- ✓  browser  test/components/CartRecommendationShelf/CartRecommendationShelf.browser.test.tsx (13 tests) 286ms
- ✓  browser  test/sdk/localization/useBindingSelector.browser.test.tsx (9 tests) 126ms
- ✓  browser  test/components/ui/ProductGallery/GalleryPageHeightLock.browser.test.tsx (8 tests) 107ms
- ✓  browser  test/sdk/session/reconcileSessionLocale.browser.test.ts (5 tests) 17ms
+ ✓  browser  test/sdk/ui/useScrollRestoration.browser.test.ts (43 tests) 1011ms
+ ✓  browser  test/components/account/ContractSwitcher.browser.test.tsx (22 tests) 2790ms
+     ✓ shows an error state when the list fails to load  760ms
+     ✓ requires selecting a contract before Confirm is enabled, then switches (REQ-03)  308ms
+ ✓  browser  test/components/account/cards/MyAccountListCards.browser.test.tsx (16 tests) 3127ms
+     ✓ shows the tab bar and renders Personal cards by default  1504ms
+     ✓ paginates when there are more than 25 cards  504ms
+ ✓  browser  test/components/account/orders/BuyingPolicyAlert.browser.test.tsx (13 tests) 2487ms
+     ✓ opens the reject confirmation modal with the default English copy  805ms
+     ✓ opens the reject confirmation modal with CMS-provided labels  387ms
+ ✓  browser  test/components/CartRecommendationShelf/CartRecommendationShelf.browser.test.tsx (13 tests) 457ms
+ ✓  browser  test/sdk/session/reconcileSessionLocale.browser.test.ts (6 tests) 22ms
+ ✓  browser  test/components/account/OrganizationDrawer.browser.test.tsx (10 tests) 1931ms
+     ✓ renders the menu view with contract details and manage footer  1038ms
+     ✓ opens the contract switcher and returns to the menu on back  359ms
+ ✓  browser  test/sdk/localization/useBindingSelector.browser.test.tsx (9 tests) 121ms
+ ✓  browser  test/components/ui/ProductGallery/GalleryPageHeightLock.browser.test.tsx (8 tests) 83ms
+ ✓  browser  test/sdk/recommendations/useRecommendationShelf.browser.test.tsx (12 tests) 92ms
 stderr | test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx
 Error in optimistic validation: TypeError: Failed to parse URL from /api/graphql?operationName=ValidateCartMutation&operationHash=3c71b0d3fc2bade14df68abfa271858beb361b12
     at node:internal/deps/undici/undici:16416:13
@@ -53,12 +57,10 @@ Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
 stderr | test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx > RecommendationShelf > renders nothing when there is an error
 Error fetching recommendations undefined boom for campaign vrn:recommendations:acc:rec-top-items-v2:campaign-1
 
- ✓  browser  test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx (8 tests) 95ms
- ✓  browser  test/sdk/recommendations/useRecommendationShelf.browser.test.tsx (12 tests) 42ms
- ✓  browser  test/components/CartSidebar/CartSidebar.browser.test.tsx (5 tests) 56ms
- ✓  browser  test/components/sections/Account/AccountOrderDetails.browser.test.tsx (4 tests) 113ms
- ✓  browser  test/components/navigation/Navbar.browser.test.tsx (3 tests) 51ms
- ✓  browser  test/sdk/session/getInitialSession.browser.test.ts (6 tests) 7ms
+ ✓  browser  test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx (8 tests) 119ms
+ ✓  browser  test/sdk/session/getInitialSession.browser.test.ts (7 tests) 9ms
+ ✓  browser  test/components/CartSidebar/CartSidebar.browser.test.tsx (5 tests) 83ms
+ ✓  browser  test/components/sections/Account/AccountOrderDetails.browser.test.tsx (4 tests) 69ms
 stderr | test/pages/password-protection.browser.test.tsx > PasswordProtectionLogin > posts the password and redirects to the requested return path
 Warning: An update to PasswordProtectionLogin inside a test was not wrapped in act(...).
 
@@ -144,6 +146,8 @@ act(() => {
 This ensures that you're testing the behavior the user would see in the browser. Learn more at https://reactjs.org/link/wrap-tests-with-act
     at PasswordProtectionLogin (/home/runner/work/faststore/faststore/packages/core/src/pages/password-protection/index.tsx:19:69)
 
+ ✓  browser  test/components/navigation/Navbar.browser.test.tsx (3 tests) 100ms
+ ✓  browser  test/components/account/OrganizationDrawerFooter.browser.test.tsx (8 tests) 508ms
 stderr | test/pages/password-protection.browser.test.tsx > PasswordProtectionLogin > uses the fallback invalid-password message when API omits an error
 Warning: An update to PasswordProtectionLogin inside a test was not wrapped in act(...).
 
@@ -288,7 +292,8 @@ act(() => {
 This ensures that you're testing the behavior the user would see in the browser. Learn more at https://reactjs.org/link/wrap-tests-with-act
     at PasswordProtectionLogin (/home/runner/work/faststore/faststore/packages/core/src/pages/password-protection/index.tsx:19:69)
 
- ✓  browser  test/pages/password-protection.browser.test.tsx (6 tests) 632ms
+ ✓  browser  test/pages/password-protection.browser.test.tsx (6 tests) 983ms
+     ✓ renders the password protection form  410ms
 stderr | test/components/cms/RenderSections.browser.test.tsx
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -297,10 +302,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/components/account/OrganizationDrawerFooter.browser.test.tsx (8 tests) 298ms
- ✓  browser  test/sdk/account/useSwitchContract.browser.test.ts (5 tests) 31ms
- ✓  browser  test/components/cms/RenderSections.browser.test.tsx (5 tests) 62ms
- ✓  browser  test/components/navigation/NavbarSlider.browser.test.tsx (2 tests) 37ms
+ ✓  browser  test/sdk/account/useSwitchContract.browser.test.ts (5 tests) 56ms
+ ✓  browser  test/components/navigation/NavbarSlider.browser.test.tsx (2 tests) 42ms
+ ✓  browser  test/components/cms/RenderSections.browser.test.tsx (5 tests) 92ms
 stderr | test/sdk/localization/store-url.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -309,15 +313,15 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/components/account/Menu.browser.test.tsx (6 tests) 279ms
- ✓  browser  test/sdk/localization/store-url.browser.test.ts (3 tests) 4ms
- ✓  browser  test/sdk/account/useAvailableContracts.browser.test.ts (6 tests) 27ms
- ✓  browser  test/components/templates/SearchPage/SearchWrapper.browser.test.tsx (3 tests) 30ms
- ✓  browser  test/sdk/recommendations/useRecommendationShelf.sessionFallback.browser.test.tsx (2 tests) 124ms
- ✓  browser  test/components/sections/Account/AccountListQuotes.browser.test.tsx (4 tests) 95ms
- ✓  browser  test/components/navigation/NavbarAccountArea.browser.test.tsx (4 tests) 47ms
- ✓  browser  test/components/CartRecommendationShelf/CartRecommendationProductCard.browser.test.tsx (3 tests) 47ms
- ✓  browser  test/sdk/account/changeContractToken.browser.test.ts (9 tests) 18ms
+ ✓  browser  test/sdk/localization/store-url.browser.test.ts (3 tests) 6ms
+ ✓  browser  test/components/account/Menu.browser.test.tsx (6 tests) 385ms
+ ✓  browser  test/sdk/account/useAvailableContracts.browser.test.ts (6 tests) 42ms
+ ✓  browser  test/components/templates/SearchPage/SearchWrapper.browser.test.tsx (3 tests) 35ms
+ ✓  browser  test/sdk/recommendations/useRecommendationShelf.sessionFallback.browser.test.tsx (2 tests) 128ms
+ ✓  browser  test/components/sections/Account/AccountListQuotes.browser.test.tsx (4 tests) 135ms
+ ✓  browser  test/components/navigation/NavbarAccountArea.browser.test.tsx (4 tests) 78ms
+ ✓  browser  test/sdk/account/changeContractToken.browser.test.ts (9 tests) 22ms
+ ✓  browser  test/components/CartRecommendationShelf/CartRecommendationProductCard.browser.test.tsx (3 tests) 54ms
 stderr | test/components/account/doLogout.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -326,9 +330,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/components/account/doLogout.browser.test.ts (1 test) 25ms
- ✓  browser  test/components/account/OrganizationDrawerHeader.browser.test.tsx (5 tests) 265ms
- ✓  browser  test/components/ui/LocalizationButton.browser.test.tsx (3 tests) 37ms
+ ✓  browser  test/components/account/doLogout.browser.test.ts (1 test) 39ms
+ ✓  browser  test/components/ui/LocalizationButton.browser.test.tsx (3 tests) 48ms
+ ✓  browser  test/components/account/OrganizationDrawerHeader.browser.test.tsx (5 tests) 359ms
 stderr | test/sdk/account/clearPersistedSessionState.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -337,14 +341,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/account/clearPersistedSessionState.browser.test.ts (4 tests) 14ms
- ✓  browser  test/components/sections/Account/AccountOrderDelivery.browser.test.tsx (2 tests) 71ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordion.browser.test.tsx (2 tests) 80ms
- ✓  browser  test/components/sections/Account/AccountOrderStatus.browser.test.tsx (3 tests) 77ms
- ✓  browser  test/components/sections/Account/AccountListCards.browser.test.tsx (3 tests) 67ms
- ✓  browser  test/components/region/useRegion.browser.test.ts (1 test) 20ms
- ✓  browser  test/components/sections/Account/AccountOrdersList.browser.test.tsx (2 tests) 22ms
- ✓  browser  test/components/account/orders/SummaryCard.browser.test.tsx (2 tests) 77ms
+ ✓  browser  test/sdk/account/clearPersistedSessionState.browser.test.ts (4 tests) 19ms
+ ✓  browser  test/components/sections/Account/AccountOrderDelivery.browser.test.tsx (2 tests) 102ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordion.browser.test.tsx (2 tests) 104ms
+ ✓  browser  test/components/sections/Account/AccountOrderStatus.browser.test.tsx (3 tests) 144ms
+ ✓  browser  test/components/region/useRegion.browser.test.ts (1 test) 17ms
+ ✓  browser  test/components/sections/Account/AccountListCards.browser.test.tsx (3 tests) 92ms
+ ✓  browser  test/components/sections/Account/AccountOrdersList.browser.test.tsx (2 tests) 30ms
+ ✓  browser  test/components/account/orders/SummaryCard.browser.test.tsx (2 tests) 105ms
 stderr | test/sdk/session/sessionStore.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -353,9 +357,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/session/sessionStore.browser.test.ts (2 tests) 9ms
- ✓  browser  test/components/account/OrganizationSignInButton.browser.test.tsx (2 tests) 186ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordionDeliveryInfo.browser.test.tsx (1 test) 26ms
+ ✓  browser  test/sdk/session/sessionStore.browser.test.ts (2 tests) 8ms
+ ✓  browser  test/components/account/OrganizationSignInButton.browser.test.tsx (2 tests) 270ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordionDeliveryInfo.browser.test.tsx (1 test) 31ms
 stderr | test/sdk/session/validateSession.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -364,14 +368,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/session/validateSession.browser.test.ts (1 test) 4ms
- ✓  browser  test/components/account/orders/StatusCard.browser.test.tsx (2 tests) 88ms
- ✓  browser  test/utils/isLocalHost.browser.test.ts (3 tests) 3ms
+ ✓  browser  test/sdk/session/validateSession.browser.test.ts (1 test) 7ms
+ ✓  browser  test/components/account/orders/StatusCard.browser.test.tsx (2 tests) 107ms
+ ✓  browser  test/utils/isLocalHost.browser.test.ts (3 tests) 4ms
  ✓  browser  test/sdk/session/reconcileSessionLocale.disabled.browser.test.ts (1 test) 3ms
- ✓  browser  test/components/account/orders/DeliveryCard.browser.test.tsx (1 test) 36ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordionProducts.browser.test.tsx (1 test) 37ms
- ✓  browser  test/components/skeletons/ProductGridSkeleton.browser.test.tsx (2 tests) 30ms
- ✓  node  test/utils/localization/bindingPaths.test.ts (71 tests) 19ms
+ ✓  browser  test/components/account/orders/DeliveryCard.browser.test.tsx (1 test) 63ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordionProducts.browser.test.tsx (1 test) 51ms
+ ✓  browser  test/components/skeletons/ProductGridSkeleton.browser.test.tsx (2 tests) 45ms
+ ✓  node  test/utils/localization/bindingPaths.test.ts (71 tests) 31ms
 stderr | test/sdk/account/refreshToken.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -380,13 +384,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/account/refreshToken.browser.test.ts (1 test) 4ms
- ✓  node  test/server/password-protection-service.test.ts (22 tests) 27ms
- ✓  node  test/pages/api/switch-contract.test.ts (25 tests) 71ms
- ✓  browser  test/components/account/orders/FilterFacetPendingApproval.browser.test.tsx (1 test) 156ms
- ✓  node  test/utils/match-url.test.ts (10 tests) 5ms
- ✓  node  test/sdk/localization/useBindingSelector.test.tsx (22 tests) 12ms
- ✓  node  test/pages/api/unlock.test.ts (15 tests) 124ms
+ ✓  browser  test/sdk/account/refreshToken.browser.test.ts (1 test) 6ms
+ ✓  node  test/server/password-protection-service.test.ts (22 tests) 37ms
+ ✓  node  test/pages/api/switch-contract.test.ts (25 tests) 92ms
+ ✓  browser  test/components/account/orders/FilterFacetPendingApproval.browser.test.tsx (1 test) 230ms
+ ✓  node  test/utils/match-url.test.ts (10 tests) 9ms
+ ✓  node  test/sdk/localization/useBindingSelector.test.tsx (22 tests) 15ms
+ ✓  node  test/pages/api/unlock.test.ts (15 tests) 141ms
+ ✓  node  test/sdk/session/syncSalesChannelFromOrderForm.test.ts (14 tests) 12ms
 stderr | test/components/search/SearchInputComponent.test.tsx
 Warning: forwardRef render functions accept exactly two parameters: props and ref. Did you forget to use the ref parameter?
 
@@ -450,24 +455,24 @@ Warning: React does not recognize the `providerProps` prop on a DOM element. If
     at Suspense
     at Wrapper (/home/runner/work/faststore/faststore/packages/core/test/components/search/SearchInputComponent.test.tsx:106:20)
 
- ✓  node  test/sdk/localization/bindingSelector.test.ts (18 tests) 8ms
- ✓  node  test/components/search/SearchInputComponent.test.tsx (6 tests) 63ms
- ✓  node  test/components/quotes/MyAccountListQuotesTable.test.tsx (15 tests) 319ms
- ✓  node  test/sdk/search/useSearchHistory.test.ts (13 tests) 32ms
+ ✓  node  test/sdk/localization/bindingSelector.test.ts (18 tests) 12ms
+ ✓  node  test/components/search/SearchInputComponent.test.tsx (6 tests) 94ms
+ ✓  node  test/components/quotes/MyAccountListQuotesTable.test.tsx (15 tests) 474ms
+ ✓  node  test/sdk/search/useSearchHistory.test.ts (13 tests) 48ms
 stderr | test/pages/pvt/account/cards/index.test.ts > Cards page getServerSideProps > redirects to /pvt/account/403 when the query fails with 401/403
 { extensions: { status: 401 } }
 
 stderr | test/pages/pvt/account/cards/index.test.ts > Cards page getServerSideProps > renders the error state (no redirect) when the query fails with a non-auth status
 { extensions: { status: 502 } }
 
- ✓  node  test/pages/pvt/account/cards/index.test.ts (8 tests) 8ms
- ✓  node  test/components/quotes/MyAccountListQuotes.test.tsx (11 tests) 800ms
+ ✓  node  test/pages/pvt/account/cards/index.test.ts (8 tests) 11ms
+ ✓  node  test/components/quotes/MyAccountListQuotes.test.tsx (11 tests) 832ms
      ✓ navigates with the search term on blur  358ms
-     ✓ navigates without a label param when the search is cleared  356ms
- ✓  node  test/components/quotes/quoteFilters.test.ts (26 tests) 28ms
- ✓  node  test/utils/cookieCacheBusting.test.ts (10 tests) 11ms
- ✓  node  test/utils/productJsonLd.test.ts (36 tests) 11ms
- ✓  node  test/experimental/myAccountCmsServerSideProps.test.ts (5 tests) 8ms
+     ✓ navigates without a label param when the search is cleared  360ms
+ ✓  node  test/components/quotes/quoteFilters.test.ts (26 tests) 29ms
+ ✓  node  test/utils/productJsonLd.test.ts (36 tests) 14ms
+ ✓  node  test/utils/cookieCacheBusting.test.ts (10 tests) 17ms
+ ✓  node  test/experimental/myAccountCmsServerSideProps.test.ts (5 tests) 22ms
 stderr | test/pages/api/graphql.test.ts > /api/graphql error status propagation > propagates the upstream 400 from a wrapped BadRequestError instead of 500
 Graphql execution returned with error:  [
   {
@@ -535,7 +540,7 @@ Warning: React does not recognize the `providerProps` prop on a DOM element. If
 
 stderr | test/pages/api/graphql.test.ts > /api/graphql request handling > maps UnauthorizedError thrown by execute to its status
 Something unexpected occurred querying Graphql endpoint: 
- ie [FastStoreError]: expired
+ ce [FastStoreError]: expired
     at /home/runner/work/faststore/faststore/packages/core/test/pages/api/graphql.test.ts:202:33
     at /home/runner/work/faststore/faststore/packages/core/test/pages/api/graphql.test.ts:207:39
     at file:///home/runner/work/faststore/faststore/node_modules/.pnpm/@vitest+runner@4.0.18/node_modules/@vitest/runner/dist/index.js:1024:60
@@ -577,71 +582,73 @@ Warning: React does not recognize the `providerProps` prop on a DOM element. If
     at trace (file:///home/runner/work/faststore/faststore/node_modules/.pnpm/vitest@4.0.18_@opentelemetry+api@1.9.0_@types+node@20.19.13_jiti@2.6.1_jsdom@27.4.0_sas_13be941c57d55f08f06eeaf1c180ddfe/node_modules/vitest/dist/chunks/test.B8ej_ZHS.js:239:21)
     at runTest (file:///home/runner/work/faststore/faststore/node_modules/.pnpm/@vitest+runner@4.0.18/node_modules/@vitest/runner/dist/index.js:1653:12)
 
- ✓  node  test/pages/api/graphql.test.ts (19 tests) 28ms
- ✓  node  test/utils/clearCookies.test.ts (20 tests) 20ms
- ✓  node  test/utils/multipleTemplates.test.ts (8 tests) 6ms
+ ✓  node  test/pages/api/graphql.test.ts (19 tests) 31ms
+ ✓  node  test/utils/clearCookies.test.ts (20 tests) 28ms
+ ✓  node  test/utils/multipleTemplates.test.ts (8 tests) 5ms
 stderr | test/sdk/account/useSetPassword.test.ts > useSetPassword > maps wrongcredentials error responses to the existing message
 Set password request failed: Bad Request
 
- ✓  node  test/sdk/account/useSetPassword.test.ts (6 tests) 38ms
- ✓  node  test/sdk/orderEntry/useOrderEntryOperation.test.ts (8 tests) 30ms
- ✓  node  test/utils/localization/localizeRedirectDestination.test.ts (11 tests) 5ms
- ✓  node  test/components/quotes/MyAccountQuotesFilterSlider.test.tsx (8 tests) 159ms
- ✓  node  test/components/quotes/MyAccountQuotesStatusSelector.test.tsx (14 tests) 163ms
- ✓  node  test/utils/localization/hreflang.test.ts (8 tests) 4ms
- ✓  node  test/sdk/account/getMyAccountRoutes.test.ts (13 tests) 7ms
- ✓  node  test/components/quotes/MyAccountQuotesSelectedTags.test.tsx (10 tests) 85ms
- ✓  node  test/sdk/redirects/index.test.ts (7 tests) 37ms
- ✓  node  test/sdk/orderEntry/useOrderEntryUpload.test.ts (8 tests) 36ms
- ✓  node  test/proxy.localization.test.ts (5 tests) 37ms
+ ✓  node  test/sdk/account/useSetPassword.test.ts (6 tests) 31ms
+ ✓  node  test/sdk/orderEntry/useOrderEntryOperation.test.ts (8 tests) 43ms
+ ✓  node  test/utils/localization/localizeRedirectDestination.test.ts (11 tests) 7ms
+ ✓  node  test/components/quotes/MyAccountQuotesFilterSlider.test.tsx (8 tests) 226ms
+ ✓  node  test/components/quotes/MyAccountQuotesStatusSelector.test.tsx (14 tests) 190ms
+ ✓  node  test/utils/localization/hreflang.test.ts (8 tests) 7ms
+ ✓  node  test/sdk/account/getMyAccountRoutes.test.ts (13 tests) 8ms
+ ✓  node  test/components/quotes/MyAccountQuotesSelectedTags.test.tsx (10 tests) 124ms
+ ✓  node  test/sdk/redirects/index.test.ts (7 tests) 51ms
+ ✓  node  test/sdk/orderEntry/useOrderEntryUpload.test.ts (8 tests) 58ms
+ ✓  node  test/proxy.localization.test.ts (5 tests) 35ms
+ ✓  node  test/sdk/orderEntry/useOrderEntry.test.ts (8 tests) 49ms
  ✓  node  test/components/account/orders/getDeliveryOptionLabel.test.ts (21 tests) 7ms
- ✓  node  test/sdk/orderEntry/useOrderEntry.test.ts (8 tests) 40ms
- ✓  node  test/sdk/graphql/retryPolicy.test.ts (18 tests) 22ms
- ✓  node  test/server/cms/myAccountDefaultSections.test.ts (9 tests) 6ms
- ✓  node  test/utils/productJsonLdRendering.test.tsx (5 tests) 13ms
- ✓  node  test/sdk/session/syncSalesChannelFromOrderForm.test.ts (6 tests) 5ms
- ✓  node  test/server/index.test.ts (7 tests) 786ms
- ✓  node  test/proxy.test.ts (4 tests) 13ms
- ✓  node  test/server/webops-api.test.ts (9 tests) 11ms
- ✓  node  test/sdk/analytics/useStartRecommendationSession.test.ts (6 tests) 40ms
- ✓  node  test/components/account/orders/StatusCard.test.ts (3 tests) 25ms
- ✓  node  test/sdk/localization/store-url.test.ts (4 tests) 4ms
- ✓  node  test/sdk/orderEntry/useOrderFormItems.test.ts (7 tests) 27ms
- ✓  node  test/sdk/cart/waitForSessionValidated.test.ts (5 tests) 9ms
- ✓  node  test/sdk/account/refreshToken.test.ts (5 tests) 10ms
+ ✓  node  test/sdk/graphql/retryPolicy.test.ts (18 tests) 23ms
+ ✓  node  test/server/cms/myAccountDefaultSections.test.ts (9 tests) 8ms
+ ✓  node  test/utils/productJsonLdRendering.test.tsx (5 tests) 12ms
+ ✓  node  test/utils/trustedForwardedHost.test.ts (27 tests) 8ms
+ ✓  node  test/server/index.test.ts (7 tests) 746ms
+ ✓  node  test/proxy.test.ts (4 tests) 23ms
+ ✓  node  test/server/webops-api.test.ts (9 tests) 14ms
+ ✓  node  test/sdk/localization/store-url.test.ts (4 tests) 5ms
+ ✓  node  test/sdk/analytics/useStartRecommendationSession.test.ts (6 tests) 77ms
+ ✓  node  test/components/account/orders/StatusCard.test.ts (3 tests) 32ms
+ ✓  node  test/sdk/orderEntry/useOrderFormItems.test.ts (7 tests) 41ms
+ ✓  node  test/sdk/cart/waitForSessionValidated.test.ts (5 tests) 13ms
+ ✓  node  test/sdk/account/refreshToken.test.ts (5 tests) 12ms
  ✓  node  test/server/content/service.test.ts (5 tests) 4ms
- ✓  node  test/server/cms/global.test.ts (3 tests) 3ms
- ✓  node  test/sdk/auth/useAuth.test.ts (5 tests) 33ms
+ ✓  node  test/server/cms/global.test.ts (3 tests) 6ms
+ ✓  node  test/sdk/auth/useAuth.test.ts (5 tests) 44ms
  ✓  node  test/utils/getRequestHostname.test.ts (12 tests) 5ms
- ✓  node  test/components/account/Layout.test.tsx (6 tests) 46ms
- ✓  node  test/server/rootSpan.test.ts (4 tests) 39ms
- ✓  node  test/pages/api/preview.test.ts (2 tests) 7ms
- ✓  node  test/utils/validateSessionRefreshToken.test.ts (6 tests) 4ms
- ✓  node  test/components/search/SearchInput.test.ts (6 tests) 6ms
- ✓  node  test/sdk/recommendations/vrn.test.ts (5 tests) 3ms
+ ✓  node  test/components/account/Layout.test.tsx (6 tests) 77ms
+ ✓  node  test/server/rootSpan.test.ts (4 tests) 48ms
+ ✓  node  test/pages/api/preview.test.ts (2 tests) 9ms
+ ✓  node  test/components/search/SearchInput.test.ts (6 tests) 13ms
+ ✓  node  test/utils/validateSessionRefreshToken.test.ts (6 tests) 6ms
+ ✓  node  test/sdk/recommendations/vrn.test.ts (5 tests) 6ms
+ ✓  node  test/components/region/useRegion.test.ts (1 test) 24ms
  ✓  node  test/server/cms/index.test.ts (2 tests) 4ms
- ✓  node  test/utils/retry.test.ts (5 tests) 12ms
- ✓  node  test/sdk/account/getB2BSessionClaims.test.ts (4 tests) 5ms
- ✓  node  test/utils/userOrderStatus.test.ts (4 tests) 4ms
- ✓  node  test/sdk/recommendations/useRecommendationUserId.test.ts (4 tests) 190ms
- ✓  node  test/components/account/OrganizationDrawerBody.test.tsx (3 tests) 33ms
+ ✓  node  test/utils/retry.test.ts (5 tests) 17ms
+ ✓  node  test/sdk/account/getB2BSessionClaims.test.ts (4 tests) 7ms
+ ✓  node  test/sdk/recommendations/useRecommendationUserId.test.ts (4 tests) 194ms
+ ✓  node  test/utils/userOrderStatus.test.ts (4 tests) 5ms
  ✓  node  test/utils/unlockResponse.test.ts (11 tests) 5ms
- ✓  node  test/sdk/recommendations/useRecommendations.test.ts (2 tests) 4ms
- ✓  node  test/utils/isLocalHost.test.ts (7 tests) 3ms
- ✓  node  test/components/quotes/MyAccountQuoteStatusBadge.test.tsx (4 tests) 41ms
- ✓  node  test/sdk/session/toSessionInput.test.ts (3 tests) 3ms
+ ✓  node  test/sdk/recommendations/useRecommendations.test.ts (2 tests) 6ms
+ ✓  node  test/components/account/OrganizationDrawerBody.test.tsx (3 tests) 43ms
+ ✓  node  test/utils/isLocalHost.test.ts (7 tests) 5ms
+ ✓  node  test/sdk/session/toSessionInput.test.ts (3 tests) 5ms
+ ✓  node  test/components/quotes/MyAccountQuoteStatusBadge.test.tsx (4 tests) 49ms
  ✓  node  test/components/account/orders/getOrderTotalLabel.test.ts (6 tests) 4ms
  ✓  node  test/components/account/orders/listOrdersLabels.test.ts (2 tests) 3ms
- ✓  node  test/utils/getCookie.test.ts (4 tests) 3ms
- ✓  node  test/sdk/session/isSignInAreaResolved.test.ts (3 tests) 3ms
- ✓  node  test/sdk/analytics/utils.test.ts (2 tests) 3ms
- ✓  node  test/components/auth/ProfileChallenge.test.tsx (3 tests) 25ms
+ ✓  node  test/utils/getCookie.test.ts (4 tests) 5ms
+ ✓  node  test/sdk/session/isSignInAreaResolved.test.ts (3 tests) 4ms
+ ✓  node  test/utils/filterChannel.test.ts (2 tests) 4ms
+ ✓  node  test/components/auth/ProfileChallenge.test.tsx (3 tests) 43ms
  ✓  node  test/instrumentation.test.ts (3 tests) 5ms
- ✓  node  test/components/account/orders/orderDetailsLabels.test.ts (1 test) 3ms
+ ✓  node  test/sdk/analytics/utils.test.ts (2 tests) 3ms
+ ✓  node  test/components/account/orders/orderDetailsLabels.test.ts (1 test) 4ms
  ✓  node  test/sdk/account/clearPersistedSessionState.test.ts (1 test) 8ms
 
- Test Files  127 passed (127)
-      Tests  992 passed (992)
-   Start at  13:35:02
-   Duration  48.01s (transform 11.84s, setup 0ms, import 44.44s, tests 17.34s, environment 57.43s)
+ Test Files  130 passed (130)
+      Tests  1032 passed (1032)
+   Start at  00:35:08
+   Duration  62.92s (transform 13.32s, setup 0ms, import 56.50s, tests 21.42s, environment 78.13s)
 

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.9.3-dev.2](https://github.com/vtex/faststore/compare/v4.9.3-dev.1...v4.9.3-dev.2) (2026-10-07)
+
+### Bug Fixes
+
+- address security & functional concerns from dk review ([d0b6106](https://github.com/vtex/faststore/commit/d0b610688ec551d8105c74750927be4ab1af7224))
+- **core:** harden x-forwarded-host handling and drop orderNumber fallback ([c1faa35](https://github.com/vtex/faststore/commit/c1faa35fe070ff8b51d4f07a5f1f33da4b17d836)), closes [#3178](https://github.com/vtex/faststore/issues/3178)
+- **core:** ignore multi-value x-forwarded-host and cover port and case ([b81d5d9](https://github.com/vtex/faststore/commit/b81d5d91721f9f8205251ad39e607b094386083c))
+- **core:** log ignored x-forwarded-host and cover CR/LF hostnames ([adaa816](https://github.com/vtex/faststore/commit/adaa81608b7e72759272e1d6d23ca6257b9a4d59))
+- **core:** make preview cookies host-only instead of rewriting their domain ([8e4901e](https://github.com/vtex/faststore/commit/8e4901ec7d127336bc27c0ae8e52c9cadea1a5a3))
+- **core:** reject hostnames that would inject Set-Cookie attributes ([059a437](https://github.com/vtex/faststore/commit/059a4377c3b1b8f66aeed2b73ce130e1ab827f77))
+- resolve ValidateCartMutation infinite loop in preview environments (SFS-3034) ([1cc9a5e](https://github.com/vtex/faststore/commit/1cc9a5efb1617f3d032623c4ee5f687ad5e2ccd9)), closes [#3178](https://github.com/vtex/faststore/issues/3178) [#3178](https://github.com/vtex/faststore/issues/3178) [#3190](https://github.com/vtex/faststore/issues/3190) [#3188](https://github.com/vtex/faststore/issues/3188) [#1467584](https://github.com/vtex/faststore/issues/1467584)
+
+## [4.9.3-dev.1](https://github.com/vtex/faststore/compare/v4.9.3-dev.0...v4.9.3-dev.1) (2026-10-06)
+
+### Bug Fixes
+
+- keep empty carts from moving the session sales channel ([#3509](https://github.com/vtex/faststore/issues/3509)) ([600fb7d](https://github.com/vtex/faststore/commit/600fb7d9403553c12bd01d6b3955f18c48f91054)), closes [#3435](https://github.com/vtex/faststore/issues/3435) [#3435](https://github.com/vtex/faststore/issues/3435)
+
 ## [4.9.3-dev.0](https://github.com/vtex/faststore/compare/v4.9.1-dev.0...v4.9.3-dev.0) (2026-10-05)
 
 **Note:** Version bump only for package @faststore/core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "4.9.3-dev.0",
+  "version": "4.9.3-dev.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -71,11 +71,11 @@
     "style-loader": "^3.3.1",
     "swr": "^2.2.5",
     "use-sync-external-store": "^1.6.0",
-    "@faststore/api": "4.9.3-dev.0",
-    "@faststore/lighthouse": "4.9.3-dev.0",
-    "@faststore/diagnostics": "4.9.3-dev.0",
-    "@faststore/ui": "4.9.3-dev.0",
-    "@faststore/sdk": "4.9.3-dev.0"
+    "@faststore/api": "4.9.3-dev.2",
+    "@faststore/diagnostics": "4.9.3-dev.2",
+    "@faststore/lighthouse": "4.9.3-dev.2",
+    "@faststore/sdk": "4.9.3-dev.2",
+    "@faststore/ui": "4.9.3-dev.2"
   },
   "devDependencies": {
     "@cypress/code-coverage": "^3.12.1",

package/src/components/region/RegionModal/useRegion.ts

@@ -41,8 +41,10 @@ export default function useRegion(): UseRegionValues {
 
     try {
       // `session` usually comes from `useSession()`, which also carries UI state
+      // and filters session-only channel keys (sales channel markers).
       const newSession = {
         ...toSessionInput(session),
+        channel: sessionStore.read()?.channel ?? session.channel,
         postalCode,
         geoCoordinates: null, // Revalidate geo coordinates in API when users set a new postal code
       } as Session

package/src/pages/api/graphql.ts

@@ -11,6 +11,11 @@ import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
 import { isLocalHost } from 'src/utils/isLocalHost'
+import {
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 import { logger } from '@faststore/diagnostics'
@@ -56,22 +61,10 @@ const shouldReplaceCookieDomain = ({
 }
 
 /**
- * Determines if host is eligible for domain normalization.
- */
-const isAllowedHost = ({
-  host,
-  allowList,
-}: {
-  host: string
-  allowList: string[]
-}) => {
-  const normalizedHost = host.toLowerCase()
-
-  return allowList.some((suffix) => normalizedHost.endsWith(suffix))
-}
-
-/**
- * Ensure the cookie domain matches the current host so the browser can store it.
+ * On allowlisted hosts (previews, localhost) the upstream cookie domain does not
+ * match the browser host, so the Domain attribute is dropped and the cookie
+ * becomes host-only. The host is never written into the cookie, so a forged
+ * x-forwarded-host cannot choose the cookie scope.
  */
 const normalizeSetCookieDomain = ({
   request,
@@ -85,20 +78,31 @@ const normalizeSetCookieDomain = ({
     return setCookie
   }
 
-  const host = getRequestHostname(request.headers.host)
+  // The preview ingress forwards a client-supplied x-forwarded-host as is, so
+  // it only decides whether the Domain is dropped, never which domain is used.
+  const forwardedHeader = request.headers['x-forwarded-host']
+  const forwardedHost = getRequestHostname(singleForwardedHost(forwardedHeader))
+  if (forwardedHeader && !forwardedHost) {
+    // The value is client-controllable, so it is not logged.
+    OTELLogger('warn', 'Ignoring multi-value or malformed x-forwarded-host')
+  }
+  const host =
+    forwardedHost && isHostAllowed(forwardedHost, ALLOWED_HOST_SUFFIXES)
+      ? forwardedHost
+      : getRequestHostname(request.headers.host)
   if (!host) {
     return setCookie
   }
   const cookieDomain = domainMatch[1]
 
   if (
-    !isAllowedHost({ host, allowList: ALLOWED_HOST_SUFFIXES }) ||
+    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
   }
 
-  return setCookie.replace(MATCH_DOMAIN_REGEXP, `; domain=${host}`)
+  return removeCookieDomain(setCookie)
 }
 
 const parseRequest = (request: NextApiRequest) => {

package/src/sdk/cart/index.ts

@@ -18,7 +18,7 @@ import {
   sessionStore,
   toSessionInput,
 } from '../session'
-import { syncSalesChannelFromOrderForm } from '../session/syncSalesChannelFromOrderForm'
+import { syncSessionWithValidatedCart } from '../session/syncSalesChannelFromOrderForm'
 import { createValidationStore, useStore } from '../useStore'
 import { waitForSessionValidated } from './waitForSessionValidated'
 
@@ -162,14 +162,16 @@ const validateCart = async (cart: Cart): Promise<Cart | null> => {
     },
   })
 
-  const adoptedSalesChannel = validated?.order?.salesChannel
-  if (adoptedSalesChannel) {
-    syncSalesChannelFromOrderForm(
-      adoptedSalesChannel,
-      () => sessionStore.read(),
-      (session) => sessionStore.setSilent(session)
-    )
-  }
+  syncSessionWithValidatedCart(
+    {
+      adoptedSalesChannel: validated?.order?.salesChannel,
+      // `null` means the browser cart is already valid.
+      itemCount: (validated ? validated.order.acceptedOffer : cart.items)
+        .length,
+    },
+    () => sessionStore.read(),
+    (session) => sessionStore.setSilent(session)
+  )
 
   return (
     validated && {

package/src/sdk/localization/useLocalizationConfig.tsx

@@ -47,6 +47,10 @@ export const useLocalizationConfig = (params?: { url?: string | URL }) => {
     const session = sessionRef.current
     const channel = JSON.parse(session.channel ?? '{}') ?? {}
     channel.salesChannel = settings.salesChannel
+    // The URL is the SC intent: validateCart never adopts over it.
+    channel.salesChannelSource = 'url'
+    // Adoption never applies on the URL SC, so a recorded rejection is moot.
+    delete channel.rejectedSalesChannel
 
     const newSession = {
       ...session,

package/src/sdk/session/initialSession.ts

@@ -46,6 +46,10 @@ export function getInitialSession(
     const settings = getSettings()
     const channel = JSON.parse(defaults.channel ?? '{}') ?? {}
     channel.salesChannel = settings.salesChannel
+    // The URL is the SC intent: validateCart never adopts over it.
+    channel.salesChannelSource = 'url'
+    // Adoption never applies on the URL SC, so a recorded rejection is moot.
+    delete channel.rejectedSalesChannel
 
     return {
       ...defaults,
@@ -81,6 +85,10 @@ export function reconcileSessionLocale(fromIDB: Session): Session {
     const settings = getSettings()
     const channel = safeParseChannel(fromIDB.channel)
     channel.salesChannel = settings.salesChannel
+    // The URL is the SC intent: validateCart never adopts over it.
+    channel.salesChannelSource = 'url'
+    // Adoption never applies on the URL SC, so a recorded rejection is moot.
+    delete channel.rejectedSalesChannel
 
     return {
       ...fromIDB,

package/src/sdk/session/syncSalesChannelFromOrderForm.ts

@@ -35,8 +35,9 @@ function readSalesChannel(channel: Record<string, unknown>): string {
  * (e.g. after Quick Order) without revalidating the cart.
  *
  * Uses `sessionStore.setSilent` so we do not trigger `cartStore.set` mid-flight
- * (that race previously wiped SC-exclusive items). Marks the channel as
- * explicit (`hasOnlyDefaultSalesChannel: false`) so `validateSession` keeps it.
+ * (that race previously wiped SC-exclusive items). Marks the channel with
+ * `salesChannelSource: 'orderForm'` so `validateSession` keeps it until the
+ * cart is empty (see `releaseAdoptedSalesChannel`).
  */
 export function syncSalesChannelFromOrderForm(
   salesChannel: string | null | undefined,
@@ -61,8 +62,60 @@ export function syncSalesChannelFromOrderForm(
       ...channel,
       salesChannel: nextSalesChannel,
       hasOnlyDefaultSalesChannel: false,
+      salesChannelSource: 'orderForm',
     }),
   })
 
   return true
 }
+
+/**
+ * Drops the orderForm adoption marker and any rejected SC once the cart has no
+ * items, so Session Manager can again reject or replace the sales channel on
+ * the next `validateSession`. The SC itself is kept: an empty `salesChannel`
+ * would reach Checkout and catalog queries.
+ */
+export function releaseAdoptedSalesChannel(
+  readSession: () => Session,
+  setSilent: (session: Session) => void
+): boolean {
+  const session = readSession()
+  const { salesChannelSource, rejectedSalesChannel, ...channel } =
+    parseChannelRecord(session.channel)
+  const isAdopted = salesChannelSource === 'orderForm'
+
+  if (!isAdopted && rejectedSalesChannel === undefined) {
+    return false
+  }
+
+  setSilent({
+    ...session,
+    channel: JSON.stringify(
+      isAdopted || salesChannelSource === undefined
+        ? channel
+        : { ...channel, salesChannelSource }
+    ),
+  })
+
+  return true
+}
+
+/**
+ * Applies the sales channel outcome of a `validateCart` to the session: adopt
+ * the orderForm SC when the API returned one, release the adoption once the
+ * cart is empty.
+ */
+export function syncSessionWithValidatedCart(
+  {
+    adoptedSalesChannel,
+    itemCount,
+  }: { adoptedSalesChannel: string | null | undefined; itemCount: number },
+  readSession: () => Session,
+  setSilent: (session: Session) => void
+) {
+  syncSalesChannelFromOrderForm(adoptedSalesChannel, readSession, setSilent)
+
+  if (itemCount === 0) {
+    releaseAdoptedSalesChannel(readSession, setSilent)
+  }
+}

package/src/utils/trustedForwardedHost.ts

@@ -0,0 +1,50 @@
+// The result is written verbatim into a Set-Cookie Domain attribute, so
+// characters such as ";" or spaces would inject cookie attributes.
+const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
+
+/**
+ * An entry starting with "." matches subdomains only; any other entry matches
+ * the host itself and its subdomains. Matching is anchored on a label boundary,
+ * so "evil-localhost" never matches "localhost".
+ */
+export function isHostAllowed(host: string, allowList: string[]) {
+  const normalizedHost = host.toLowerCase()
+
+  if (!HOSTNAME_PATTERN.test(normalizedHost)) {
+    return false
+  }
+
+  return allowList.some((entry) =>
+    entry.startsWith('.')
+      ? normalizedHost.endsWith(entry)
+      : normalizedHost === entry || normalizedHost.endsWith(`.${entry}`)
+  )
+}
+
+/**
+ * Returns the `x-forwarded-host` value only when exactly one is present.
+ *
+ * Which hop of a proxy chain is trustworthy is not known here: with several
+ * values the leftmost one is whatever the client sent. So a multi-value header
+ * (comma-joined by Node, or an array) is ignored and the caller falls back to
+ * `host`. A single value still assumes the ingress overwrites the header.
+ */
+export function singleForwardedHost(
+  header: string | string[] | undefined
+): string | undefined {
+  if (Array.isArray(header)) {
+    return header.length === 1 ? singleForwardedHost(header[0]) : undefined
+  }
+
+  const value = header?.trim()
+
+  return value && !value.includes(',') ? value : undefined
+}
+
+/**
+ * Drops every Domain attribute so the cookie becomes host-only: the browser
+ * scopes it to the exact host it requested, whatever header picked this path.
+ */
+export function removeCookieDomain(setCookie: string): string {
+  return setCookie.replaceAll(/;\s*domain=[^;]*/gi, '')
+}

package/src/utils/utilities.ts

@@ -110,9 +110,9 @@ export const toArray = <T>(x: T[] | T | undefined) =>
   Array.isArray(x) ? x : x ? [x] : []
 
 /**
- * Filters the channel object by removing the hasOnlyDefaultSalesChannel key.
- * This key is used only in the useAuth hook and is only required to send on the ValidateSession mutation,
- * so we remove it from the session's channel object to avoid unnecessary cache invalidations and query executions
+ * Filters the channel object by removing the hasOnlyDefaultSalesChannel, salesChannelSource and rejectedSalesChannel keys.
+ * These keys are session-only (useAuth and the ValidateSession/ValidateCart mutations),
+ * so we remove them from the session's channel object to avoid unnecessary cache invalidations and query executions
  *
  * @param channel - The channel string to filter.
  * @returns The filtered channel string.
@@ -122,8 +122,12 @@ export function filterChannel(channel: string): string {
     return '{}'
   }
   try {
-    const { hasOnlyDefaultSalesChannel, ...filteredChannel } =
-      JSON.parse(channel)
+    const {
+      hasOnlyDefaultSalesChannel,
+      salesChannelSource,
+      rejectedSalesChannel,
+      ...filteredChannel
+    } = JSON.parse(channel)
     return JSON.stringify(filteredChannel)
   } catch {
     console.warn('[filterChannel] Invalid channel JSON:', channel)

package/test/components/region/useRegion.browser.test.ts

@@ -7,7 +7,7 @@ const mockSessionSet = vi.hoisted(() => vi.fn())
 
 vi.mock('src/sdk/session', async () => ({
   validateSession: mockValidateSession,
-  sessionStore: { set: mockSessionSet },
+  sessionStore: { set: mockSessionSet, read: vi.fn() },
   toSessionInput: (await import('src/sdk/session/toSessionInput'))
     .toSessionInput,
 }))

package/test/components/region/useRegion.test.ts

@@ -0,0 +1,67 @@
+/**
+ * @vitest-environment jsdom
+ */
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockRead, mockSet, mockValidateSession } = vi.hoisted(() => ({
+  mockRead: vi.fn(),
+  mockSet: vi.fn(),
+  mockValidateSession: vi.fn(),
+}))
+
+vi.mock('src/sdk/session', async () => ({
+  sessionStore: { read: mockRead, set: mockSet },
+  validateSession: mockValidateSession,
+  toSessionInput: (await import('src/sdk/session/toSessionInput'))
+    .toSessionInput,
+}))
+vi.mock('discovery.config', () => ({ deliveryPromise: { enabled: false } }))
+vi.mock('src/sdk/product', () => ({ getProductCount: vi.fn() }))
+
+import useRegion from '../../../src/components/region/RegionModal/useRegion'
+
+// What `useSession()` hands to region components: `filterChannel` already
+// stripped the session-only keys.
+const filteredSession = {
+  locale: 'en-US',
+  currency: { code: 'USD', symbol: '$' },
+  country: 'USA',
+  channel: JSON.stringify({ salesChannel: '4', regionId: '' }),
+  postalCode: null,
+} as any
+
+const storedChannel = JSON.stringify({
+  salesChannel: '4',
+  regionId: '',
+  hasOnlyDefaultSalesChannel: false,
+  rejectedSalesChannel: '6',
+})
+
+describe('useRegion', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRead.mockReturnValue({ ...filteredSession, channel: storedChannel })
+    mockValidateSession.mockImplementation(async (session) => session)
+  })
+
+  it('validates the new postal code with the stored channel, keeping session-only keys', async () => {
+    const { result } = renderHook(() => useRegion())
+
+    await act(() =>
+      result.current.setRegion({
+        session: filteredSession,
+        postalCode: '10001',
+        errorMessage: 'error',
+      })
+    )
+
+    expect(mockValidateSession).toHaveBeenCalledWith(
+      expect.objectContaining({ channel: storedChannel, postalCode: '10001' })
+    )
+    expect(mockSet).toHaveBeenCalledWith(
+      expect.objectContaining({ channel: storedChannel })
+    )
+  })
+})

package/test/sdk/session/getInitialSession.browser.test.ts

@@ -134,6 +134,14 @@ describe('getInitialSession (browser, localization enabled)', () => {
     expect(channel.regionId).toBe('region-abc')
   })
 
+  it('marks the URL-derived salesChannel as intentional', () => {
+    stubHref('https://store.example.com/en-US/some/path')
+
+    const result = getInitialSession(defaults)
+
+    expect(JSON.parse(result.channel ?? '{}').salesChannelSource).toBe('url')
+  })
+
   it('preserves non-locale defaults (country, person, etc.)', () => {
     stubHref('https://store.example.com/en-US/some/path')
 

package/test/sdk/session/reconcileSessionLocale.browser.test.ts

@@ -165,6 +165,22 @@ describe('reconcileSessionLocale (browser, localization enabled)', () => {
     expect(channel.customKey).toBe('keep-me')
   })
 
+  it('marks the URL salesChannel as intentional, replacing an orderForm adoption', () => {
+    stubHref('https://store.example.com/pt-BR/some/path')
+
+    const payload: Session = {
+      ...STALE,
+      channel:
+        '{"salesChannel":"4","salesChannelSource":"orderForm","rejectedSalesChannel":"6"}',
+    }
+
+    const channel = JSON.parse(reconcileSessionLocale(payload).channel ?? '{}')
+
+    expect(channel.salesChannel).toBe('1')
+    expect(channel.salesChannelSource).toBe('url')
+    expect(channel).not.toHaveProperty('rejectedSalesChannel')
+  })
+
   it('survives a malformed channel JSON in the payload (does not throw, still reconciles)', () => {
     stubHref('https://store.example.com/pt-BR/some/path')
 

package/test/sdk/session/syncSalesChannelFromOrderForm.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { Session } from '@faststore/sdk'
-import { syncSalesChannelFromOrderForm } from '../../../src/sdk/session/syncSalesChannelFromOrderForm'
+import {
+  releaseAdoptedSalesChannel,
+  syncSalesChannelFromOrderForm,
+  syncSessionWithValidatedCart,
+} from '../../../src/sdk/session/syncSalesChannelFromOrderForm'
 
 const baseSession = (
   salesChannel: string,
@@ -44,6 +48,7 @@ describe('syncSalesChannelFromOrderForm', () => {
     expect(JSON.parse(next.channel ?? '{}')).toMatchObject({
       salesChannel: '2',
       hasOnlyDefaultSalesChannel: false,
+      salesChannelSource: 'orderForm',
     })
   })
 
@@ -123,3 +128,155 @@ describe('syncSalesChannelFromOrderForm', () => {
     )
   })
 })
+
+describe('releaseAdoptedSalesChannel', () => {
+  const withChannel = (channel: Record<string, unknown>) =>
+    baseSession('', true, JSON.stringify(channel))
+
+  it('drops the orderForm marker and keeps the rest of the channel', () => {
+    const setSilent = vi.fn()
+    const released = releaseAdoptedSalesChannel(
+      () =>
+        withChannel({
+          salesChannel: '4',
+          regionId: 'r1',
+          hasOnlyDefaultSalesChannel: false,
+          salesChannelSource: 'orderForm',
+        }),
+      setSilent
+    )
+
+    expect(released).toBe(true)
+    expect(JSON.parse(setSilent.mock.calls[0][0].channel)).toEqual({
+      salesChannel: '4',
+      regionId: 'r1',
+      hasOnlyDefaultSalesChannel: false,
+    })
+  })
+
+  it('drops a rejected SC together with the adoption marker', () => {
+    const setSilent = vi.fn()
+
+    releaseAdoptedSalesChannel(
+      () =>
+        withChannel({
+          salesChannel: '4',
+          salesChannelSource: 'orderForm',
+          rejectedSalesChannel: '6',
+        }),
+      setSilent
+    )
+
+    expect(JSON.parse(setSilent.mock.calls[0][0].channel)).toEqual({
+      salesChannel: '4',
+    })
+  })
+
+  it('drops a rejected SC left after the adoption was dropped', () => {
+    const setSilent = vi.fn()
+
+    expect(
+      releaseAdoptedSalesChannel(
+        () => withChannel({ salesChannel: '4', rejectedSalesChannel: '6' }),
+        setSilent
+      )
+    ).toBe(true)
+    expect(JSON.parse(setSilent.mock.calls[0][0].channel)).toEqual({
+      salesChannel: '4',
+    })
+  })
+
+  it('keeps the URL marker when dropping a rejected SC', () => {
+    const setSilent = vi.fn()
+
+    releaseAdoptedSalesChannel(
+      () =>
+        withChannel({
+          salesChannel: '3',
+          salesChannelSource: 'url',
+          rejectedSalesChannel: '6',
+        }),
+      setSilent
+    )
+
+    expect(JSON.parse(setSilent.mock.calls[0][0].channel)).toEqual({
+      salesChannel: '3',
+      salesChannelSource: 'url',
+    })
+  })
+
+  it('is a no-op without the orderForm marker', () => {
+    const setSilent = vi.fn()
+
+    expect(
+      releaseAdoptedSalesChannel(
+        () => withChannel({ salesChannel: '4' }),
+        setSilent
+      )
+    ).toBe(false)
+    expect(
+      releaseAdoptedSalesChannel(
+        () => withChannel({ salesChannel: '3', salesChannelSource: 'url' }),
+        setSilent
+      )
+    ).toBe(false)
+    expect(
+      releaseAdoptedSalesChannel(() => baseSession('', true, '{'), setSilent)
+    ).toBe(false)
+    expect(setSilent).not.toHaveBeenCalled()
+  })
+})
+
+describe('syncSessionWithValidatedCart', () => {
+  const store = (channel: Record<string, unknown>) => {
+    let session = baseSession('', true, JSON.stringify(channel))
+    const setSilent = vi.fn((next: Session) => {
+      session = next
+    })
+
+    return {
+      read: () => session,
+      setSilent,
+      channel: () => JSON.parse(session.channel ?? '{}'),
+    }
+  }
+
+  it('adopts the returned SC and keeps the marker while the cart has items', () => {
+    const s = store({ salesChannel: '2' })
+
+    syncSessionWithValidatedCart(
+      { adoptedSalesChannel: '4', itemCount: 1 },
+      s.read,
+      s.setSilent
+    )
+
+    expect(s.channel()).toMatchObject({
+      salesChannel: '4',
+      salesChannelSource: 'orderForm',
+    })
+  })
+
+  it('releases the adoption once the validated cart is empty', () => {
+    const s = store({ salesChannel: '4', salesChannelSource: 'orderForm' })
+
+    syncSessionWithValidatedCart(
+      { adoptedSalesChannel: null, itemCount: 0 },
+      s.read,
+      s.setSilent
+    )
+
+    expect(s.channel()).toEqual({ salesChannel: '4' })
+  })
+
+  it('leaves the session untouched when nothing was adopted and the cart has items', () => {
+    const s = store({ salesChannel: '4', salesChannelSource: 'orderForm' })
+
+    syncSessionWithValidatedCart(
+      { adoptedSalesChannel: undefined, itemCount: 2 },
+      s.read,
+      s.setSilent
+    )
+
+    expect(s.setSilent).not.toHaveBeenCalled()
+  })
+})

package/test/utils/filterChannel.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest'
+
+import { filterChannel } from 'src/utils/utilities'
+
+describe('filterChannel', () => {
+  it('strips session-only keys so they never reach queries or cache keys', () => {
+    expect(
+      JSON.parse(
+        filterChannel(
+          JSON.stringify({
+            salesChannel: '4',
+            regionId: 'r1',
+            hasOnlyDefaultSalesChannel: false,
+            salesChannelSource: 'orderForm',
+            rejectedSalesChannel: '6',
+          })
+        )
+      )
+    ).toEqual({ salesChannel: '4', regionId: 'r1' })
+  })
+
+  it('returns an empty object for an empty channel', () => {
+    expect(filterChannel('')).toBe('{}')
+  })
+})

package/test/utils/trustedForwardedHost.test.ts

@@ -0,0 +1,105 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  singleForwardedHost,
+  isHostAllowed,
+  removeCookieDomain,
+} from '../../src/utils/trustedForwardedHost'
+
+const ALLOW_LIST = ['localhost', '.vtex.app', '.localhost']
+
+describe('isHostAllowed', () => {
+  it.each([
+    'localhost',
+    'store.vtex.app',
+    'sfj-1--acc.preview.vtex.app',
+    'a.localhost',
+  ])('allows %s', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'evil-localhost',
+    'notlocalhost',
+    'evil-vtex.app',
+    'vtex.app.evil.com',
+    'evil.com',
+  ])('rejects %s', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('isHostAllowed normalization', () => {
+  it('is case-insensitive', () => {
+    expect(isHostAllowed('Store.VTEX.app', ALLOW_LIST)).toBe(true)
+    expect(isHostAllowed('LOCALHOST', ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'x;max-age=0;y.vtex.app',
+    'a b.vtex.app',
+    'x"y.vtex.app',
+    'x=y.vtex.app',
+    'x,y.vtex.app',
+    'x\r\nSet-Cookie: evil=1.vtex.app',
+    'x\ny.vtex.app',
+    'x\ry.vtex.app',
+  ])('rejects %s, which would inject cookie attributes', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+
+  it('accepts punycode hostnames', () => {
+    expect(isHostAllowed('xn--lja-bma.vtex.app', ALLOW_LIST)).toBe(true)
+  })
+
+  it('expects a hostname: a port is not stripped here', () => {
+    expect(isHostAllowed('store.vtex.app:8080', ALLOW_LIST)).toBe(false)
+    expect(isHostAllowed('evil.com:vtex.app', ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('singleForwardedHost', () => {
+  it('returns the value when there is exactly one', () => {
+    expect(singleForwardedHost('a.vtex.app')).toBe('a.vtex.app')
+    expect(singleForwardedHost(' a.vtex.app ')).toBe('a.vtex.app')
+    expect(singleForwardedHost(['a.vtex.app'])).toBe('a.vtex.app')
+  })
+
+  it('returns undefined when missing or empty', () => {
+    expect(singleForwardedHost(undefined)).toBeUndefined()
+    expect(singleForwardedHost('')).toBeUndefined()
+    expect(singleForwardedHost([])).toBeUndefined()
+  })
+
+  it('ignores multi-value headers instead of picking one', () => {
+    expect(singleForwardedHost('a.vtex.app, evil.com')).toBeUndefined()
+    expect(singleForwardedHost('evil.com, a.vtex.app')).toBeUndefined()
+    expect(singleForwardedHost(['a.vtex.app', 'evil.com'])).toBeUndefined()
+  })
+})
+
+describe('removeCookieDomain', () => {
+  it('drops the Domain attribute and keeps the rest', () => {
+    expect(
+      removeCookieDomain(
+        'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; domain=acc.vtexcommercestable.com.br; path=/; secure; samesite=lax; httponly'
+      )
+    ).toBe(
+      'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; path=/; secure; samesite=lax; httponly'
+    )
+  })
+
+  it('is case-insensitive and removes repeated Domain attributes', () => {
+    expect(removeCookieDomain('a=1; Domain=x.com; DOMAIN=y.com; Path=/')).toBe(
+      'a=1; Path=/'
+    )
+  })
+
+  it('does not touch a cookie whose name is domain', () => {
+    expect(removeCookieDomain('domain=1; path=/')).toBe('domain=1; path=/')
+  })
+
+  it('keeps cookies without a Domain attribute unchanged', () => {
+    expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
+  })
+})