@faststore/core 4.9.3-dev.1 → 4.9.3-dev.2

package/.turbo/turbo-generate.log

@@ -1,9 +1,9 @@
 
-> @faststore/core@4.9.3-dev.0 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 generate /home/runner/work/faststore/faststore/packages/core
 > pnpm run gen-types && pnpm run cache-graphql 
 
 
-> @faststore/core@4.9.3-dev.0 gen-types /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 gen-types /home/runner/work/faststore/faststore/packages/core
 > node ../cli/bin/run generate-types .
 
 [STARTED] Parse Configuration
@@ -19,7 +19,7 @@
 [COMPLETED] Generate to @generated/
 [COMPLETED] Generate outputs
 
-> @faststore/core@4.9.3-dev.0 cache-graphql /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 cache-graphql /home/runner/work/faststore/faststore/packages/core
 > node ../cli/bin/run cache-graphql --config=./discovery.config.default.js --queries=./@generated/persisted-documents.json
 
 [Info] - Config file location: /home/runner/work/faststore/faststore/packages/core/discovery.config.default.js

package/.turbo/turbo-test.log

@@ -1,5 +1,5 @@
 
-> @faststore/core@4.9.3-dev.0 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@4.9.3-dev.1 test /home/runner/work/faststore/faststore/packages/core
 > vitest run
 
 
@@ -7,33 +7,27 @@
 
 Not implemented: navigation to another Document
 Not implemented: navigation to another Document
- ✓  browser  test/sdk/ui/useScrollRestoration.browser.test.ts (43 tests) 1198ms
 Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
- ✓  browser  test/components/account/ContractSwitcher.browser.test.tsx (22 tests) 4246ms
-     ✓ shows an error state when the list fails to load  715ms
-     ✓ requires selecting a contract before Confirm is enabled, then switches (REQ-03)  424ms
-     ✓ keeps Confirm disabled until a different contract is selected  371ms
-     ✓ keeps Confirm disabled when switching is unavailable  368ms
-     ✓ keeps Confirm disabled when the selected contract is filtered out  345ms
-     ✓ honors CMS-provided labels for the header, current session, search, footer, and available count  363ms
- ✓  browser  test/components/account/cards/MyAccountListCards.browser.test.tsx (16 tests) 3043ms
-     ✓ shows the tab bar and renders Personal cards by default  1270ms
-     ✓ paginates when there are more than 25 cards  355ms
- ✓  browser  test/components/account/orders/BuyingPolicyAlert.browser.test.tsx (13 tests) 3166ms
-     ✓ opens the reject confirmation modal with the default English copy  1303ms
-     ✓ opens the reject confirmation modal with CMS-provided labels  418ms
-     ✓ shows the default English toast when a policy is rejected  314ms
- ✓  browser  test/components/CartRecommendationShelf/CartRecommendationShelf.browser.test.tsx (13 tests) 304ms
- ✓  browser  test/sdk/localization/useBindingSelector.browser.test.tsx (9 tests) 108ms
- ✓  browser  test/components/account/OrganizationDrawer.browser.test.tsx (10 tests) 2015ms
-     ✓ renders the menu view with contract details and manage footer  994ms
-     ✓ opens the contract switcher and returns to the menu on back  367ms
-     ✓ resets to the menu when the drawer closes  329ms
- ✓  browser  test/sdk/session/reconcileSessionLocale.browser.test.ts (6 tests) 20ms
- ✓  browser  test/components/ui/ProductGallery/GalleryPageHeightLock.browser.test.tsx (8 tests) 99ms
- ✓  browser  test/sdk/recommendations/useRecommendationShelf.browser.test.tsx (12 tests) 71ms
+ ✓  browser  test/sdk/ui/useScrollRestoration.browser.test.ts (43 tests) 1011ms
+ ✓  browser  test/components/account/ContractSwitcher.browser.test.tsx (22 tests) 2790ms
+     ✓ shows an error state when the list fails to load  760ms
+     ✓ requires selecting a contract before Confirm is enabled, then switches (REQ-03)  308ms
+ ✓  browser  test/components/account/cards/MyAccountListCards.browser.test.tsx (16 tests) 3127ms
+     ✓ shows the tab bar and renders Personal cards by default  1504ms
+     ✓ paginates when there are more than 25 cards  504ms
+ ✓  browser  test/components/account/orders/BuyingPolicyAlert.browser.test.tsx (13 tests) 2487ms
+     ✓ opens the reject confirmation modal with the default English copy  805ms
+     ✓ opens the reject confirmation modal with CMS-provided labels  387ms
+ ✓  browser  test/components/CartRecommendationShelf/CartRecommendationShelf.browser.test.tsx (13 tests) 457ms
+ ✓  browser  test/sdk/session/reconcileSessionLocale.browser.test.ts (6 tests) 22ms
+ ✓  browser  test/components/account/OrganizationDrawer.browser.test.tsx (10 tests) 1931ms
+     ✓ renders the menu view with contract details and manage footer  1038ms
+     ✓ opens the contract switcher and returns to the menu on back  359ms
+ ✓  browser  test/sdk/localization/useBindingSelector.browser.test.tsx (9 tests) 121ms
+ ✓  browser  test/components/ui/ProductGallery/GalleryPageHeightLock.browser.test.tsx (8 tests) 83ms
+ ✓  browser  test/sdk/recommendations/useRecommendationShelf.browser.test.tsx (12 tests) 92ms
 stderr | test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx
 Error in optimistic validation: TypeError: Failed to parse URL from /api/graphql?operationName=ValidateCartMutation&operationHash=3c71b0d3fc2bade14df68abfa271858beb361b12
     at node:internal/deps/undici/undici:16416:13
@@ -63,11 +57,10 @@ Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
 stderr | test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx > RecommendationShelf > renders nothing when there is an error
 Error fetching recommendations undefined boom for campaign vrn:recommendations:acc:rec-top-items-v2:campaign-1
 
- ✓  browser  test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx (8 tests) 165ms
- ✓  browser  test/components/CartSidebar/CartSidebar.browser.test.tsx (5 tests) 75ms
- ✓  browser  test/components/sections/Account/AccountOrderDetails.browser.test.tsx (4 tests) 93ms
- ✓  browser  test/sdk/session/getInitialSession.browser.test.ts (7 tests) 11ms
- ✓  browser  test/components/navigation/Navbar.browser.test.tsx (3 tests) 92ms
+ ✓  browser  test/components/RecommendationShelf/RecommendationShelf.browser.test.tsx (8 tests) 119ms
+ ✓  browser  test/sdk/session/getInitialSession.browser.test.ts (7 tests) 9ms
+ ✓  browser  test/components/CartSidebar/CartSidebar.browser.test.tsx (5 tests) 83ms
+ ✓  browser  test/components/sections/Account/AccountOrderDetails.browser.test.tsx (4 tests) 69ms
 stderr | test/pages/password-protection.browser.test.tsx > PasswordProtectionLogin > posts the password and redirects to the requested return path
 Warning: An update to PasswordProtectionLogin inside a test was not wrapped in act(...).
 
@@ -153,6 +146,8 @@ act(() => {
 This ensures that you're testing the behavior the user would see in the browser. Learn more at https://reactjs.org/link/wrap-tests-with-act
     at PasswordProtectionLogin (/home/runner/work/faststore/faststore/packages/core/src/pages/password-protection/index.tsx:19:69)
 
+ ✓  browser  test/components/navigation/Navbar.browser.test.tsx (3 tests) 100ms
+ ✓  browser  test/components/account/OrganizationDrawerFooter.browser.test.tsx (8 tests) 508ms
 stderr | test/pages/password-protection.browser.test.tsx > PasswordProtectionLogin > uses the fallback invalid-password message when API omits an error
 Warning: An update to PasswordProtectionLogin inside a test was not wrapped in act(...).
 
@@ -249,7 +244,6 @@ act(() => {
 This ensures that you're testing the behavior the user would see in the browser. Learn more at https://reactjs.org/link/wrap-tests-with-act
     at PasswordProtectionLogin (/home/runner/work/faststore/faststore/packages/core/src/pages/password-protection/index.tsx:19:69)
 
- ✓  browser  test/components/account/OrganizationDrawerFooter.browser.test.tsx (8 tests) 545ms
 stderr | test/pages/password-protection.browser.test.tsx > PasswordProtectionLogin > shows service unavailable when the login request fails
 Warning: An update to PasswordProtectionLogin inside a test was not wrapped in act(...).
 
@@ -298,8 +292,8 @@ act(() => {
 This ensures that you're testing the behavior the user would see in the browser. Learn more at https://reactjs.org/link/wrap-tests-with-act
     at PasswordProtectionLogin (/home/runner/work/faststore/faststore/packages/core/src/pages/password-protection/index.tsx:19:69)
 
- ✓  browser  test/pages/password-protection.browser.test.tsx (6 tests) 997ms
-     ✓ renders the password protection form  459ms
+ ✓  browser  test/pages/password-protection.browser.test.tsx (6 tests) 983ms
+     ✓ renders the password protection form  410ms
 stderr | test/components/cms/RenderSections.browser.test.tsx
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -308,9 +302,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/account/useSwitchContract.browser.test.ts (5 tests) 54ms
- ✓  browser  test/components/navigation/NavbarSlider.browser.test.tsx (2 tests) 45ms
- ✓  browser  test/components/cms/RenderSections.browser.test.tsx (5 tests) 102ms
+ ✓  browser  test/sdk/account/useSwitchContract.browser.test.ts (5 tests) 56ms
+ ✓  browser  test/components/navigation/NavbarSlider.browser.test.tsx (2 tests) 42ms
+ ✓  browser  test/components/cms/RenderSections.browser.test.tsx (5 tests) 92ms
 stderr | test/sdk/localization/store-url.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -320,14 +314,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
  ✓  browser  test/sdk/localization/store-url.browser.test.ts (3 tests) 6ms
- ✓  browser  test/components/account/Menu.browser.test.tsx (6 tests) 403ms
- ✓  browser  test/sdk/account/useAvailableContracts.browser.test.ts (6 tests) 28ms
- ✓  browser  test/components/templates/SearchPage/SearchWrapper.browser.test.tsx (3 tests) 42ms
- ✓  browser  test/sdk/recommendations/useRecommendationShelf.sessionFallback.browser.test.tsx (2 tests) 139ms
- ✓  browser  test/components/sections/Account/AccountListQuotes.browser.test.tsx (4 tests) 104ms
- ✓  browser  test/components/navigation/NavbarAccountArea.browser.test.tsx (4 tests) 72ms
- ✓  browser  test/components/CartRecommendationShelf/CartRecommendationProductCard.browser.test.tsx (3 tests) 49ms
- ✓  browser  test/sdk/account/changeContractToken.browser.test.ts (9 tests) 20ms
+ ✓  browser  test/components/account/Menu.browser.test.tsx (6 tests) 385ms
+ ✓  browser  test/sdk/account/useAvailableContracts.browser.test.ts (6 tests) 42ms
+ ✓  browser  test/components/templates/SearchPage/SearchWrapper.browser.test.tsx (3 tests) 35ms
+ ✓  browser  test/sdk/recommendations/useRecommendationShelf.sessionFallback.browser.test.tsx (2 tests) 128ms
+ ✓  browser  test/components/sections/Account/AccountListQuotes.browser.test.tsx (4 tests) 135ms
+ ✓  browser  test/components/navigation/NavbarAccountArea.browser.test.tsx (4 tests) 78ms
+ ✓  browser  test/sdk/account/changeContractToken.browser.test.ts (9 tests) 22ms
+ ✓  browser  test/components/CartRecommendationShelf/CartRecommendationProductCard.browser.test.tsx (3 tests) 54ms
 stderr | test/components/account/doLogout.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -336,9 +330,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/components/account/doLogout.browser.test.ts (1 test) 35ms
- ✓  browser  test/components/ui/LocalizationButton.browser.test.tsx (3 tests) 36ms
- ✓  browser  test/components/account/OrganizationDrawerHeader.browser.test.tsx (5 tests) 383ms
+ ✓  browser  test/components/account/doLogout.browser.test.ts (1 test) 39ms
+ ✓  browser  test/components/ui/LocalizationButton.browser.test.tsx (3 tests) 48ms
+ ✓  browser  test/components/account/OrganizationDrawerHeader.browser.test.tsx (5 tests) 359ms
 stderr | test/sdk/account/clearPersistedSessionState.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -347,14 +341,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/account/clearPersistedSessionState.browser.test.ts (4 tests) 14ms
- ✓  browser  test/components/sections/Account/AccountOrderDelivery.browser.test.tsx (2 tests) 103ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordion.browser.test.tsx (2 tests) 106ms
- ✓  browser  test/components/sections/Account/AccountOrderStatus.browser.test.tsx (3 tests) 127ms
- ✓  browser  test/components/region/useRegion.browser.test.ts (1 test) 18ms
- ✓  browser  test/components/sections/Account/AccountListCards.browser.test.tsx (3 tests) 94ms
- ✓  browser  test/components/sections/Account/AccountOrdersList.browser.test.tsx (2 tests) 31ms
- ✓  browser  test/components/account/orders/SummaryCard.browser.test.tsx (2 tests) 107ms
+ ✓  browser  test/sdk/account/clearPersistedSessionState.browser.test.ts (4 tests) 19ms
+ ✓  browser  test/components/sections/Account/AccountOrderDelivery.browser.test.tsx (2 tests) 102ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordion.browser.test.tsx (2 tests) 104ms
+ ✓  browser  test/components/sections/Account/AccountOrderStatus.browser.test.tsx (3 tests) 144ms
+ ✓  browser  test/components/region/useRegion.browser.test.ts (1 test) 17ms
+ ✓  browser  test/components/sections/Account/AccountListCards.browser.test.tsx (3 tests) 92ms
+ ✓  browser  test/components/sections/Account/AccountOrdersList.browser.test.tsx (2 tests) 30ms
+ ✓  browser  test/components/account/orders/SummaryCard.browser.test.tsx (2 tests) 105ms
 stderr | test/sdk/session/sessionStore.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -363,9 +357,9 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/components/account/OrganizationSignInButton.browser.test.tsx (2 tests) 314ms
- ✓  browser  test/sdk/session/sessionStore.browser.test.ts (2 tests) 6ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordionDeliveryInfo.browser.test.tsx (1 test) 44ms
+ ✓  browser  test/sdk/session/sessionStore.browser.test.ts (2 tests) 8ms
+ ✓  browser  test/components/account/OrganizationSignInButton.browser.test.tsx (2 tests) 270ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordionDeliveryInfo.browser.test.tsx (1 test) 31ms
 stderr | test/sdk/session/validateSession.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -375,13 +369,13 @@ This ensures that you're testing the behavior the user would see in the browser.
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
  ✓  browser  test/sdk/session/validateSession.browser.test.ts (1 test) 7ms
- ✓  browser  test/components/account/orders/StatusCard.browser.test.tsx (2 tests) 123ms
- ✓  browser  test/utils/isLocalHost.browser.test.ts (3 tests) 5ms
- ✓  browser  test/sdk/session/reconcileSessionLocale.disabled.browser.test.ts (1 test) 4ms
- ✓  browser  test/components/account/orders/DeliveryCard.browser.test.tsx (1 test) 55ms
- ✓  browser  test/components/account/orders/DeliveryOptionAccordionProducts.browser.test.tsx (1 test) 56ms
- ✓  browser  test/components/skeletons/ProductGridSkeleton.browser.test.tsx (2 tests) 30ms
- ✓  node  test/utils/localization/bindingPaths.test.ts (71 tests) 29ms
+ ✓  browser  test/components/account/orders/StatusCard.browser.test.tsx (2 tests) 107ms
+ ✓  browser  test/utils/isLocalHost.browser.test.ts (3 tests) 4ms
+ ✓  browser  test/sdk/session/reconcileSessionLocale.disabled.browser.test.ts (1 test) 3ms
+ ✓  browser  test/components/account/orders/DeliveryCard.browser.test.tsx (1 test) 63ms
+ ✓  browser  test/components/account/orders/DeliveryOptionAccordionProducts.browser.test.tsx (1 test) 51ms
+ ✓  browser  test/components/skeletons/ProductGridSkeleton.browser.test.tsx (2 tests) 45ms
+ ✓  node  test/utils/localization/bindingPaths.test.ts (71 tests) 31ms
 stderr | test/sdk/account/refreshToken.browser.test.ts
 Error in optimistic validation: TypeError: Cannot read properties of undefined (reading 'read')
     at waitForSessionValidated (/home/runner/work/faststore/faststore/packages/core/src/sdk/cart/waitForSessionValidated.ts:16:32)
@@ -390,13 +384,14 @@ This ensures that you're testing the behavior the user would see in the browser.
     at a (/home/runner/work/faststore/faststore/packages/sdk/dist/es/index.mjs:357:23)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
 
- ✓  browser  test/sdk/account/refreshToken.browser.test.ts (1 test) 8ms
- ✓  node  test/server/password-protection-service.test.ts (22 tests) 41ms
- ✓  node  test/pages/api/switch-contract.test.ts (25 tests) 89ms
- ✓  browser  test/components/account/orders/FilterFacetPendingApproval.browser.test.tsx (1 test) 223ms
- ✓  node  test/utils/match-url.test.ts (10 tests) 8ms
+ ✓  browser  test/sdk/account/refreshToken.browser.test.ts (1 test) 6ms
+ ✓  node  test/server/password-protection-service.test.ts (22 tests) 37ms
+ ✓  node  test/pages/api/switch-contract.test.ts (25 tests) 92ms
+ ✓  browser  test/components/account/orders/FilterFacetPendingApproval.browser.test.tsx (1 test) 230ms
+ ✓  node  test/utils/match-url.test.ts (10 tests) 9ms
  ✓  node  test/sdk/localization/useBindingSelector.test.tsx (22 tests) 15ms
- ✓  node  test/pages/api/unlock.test.ts (15 tests) 209ms
+ ✓  node  test/pages/api/unlock.test.ts (15 tests) 141ms
+ ✓  node  test/sdk/session/syncSalesChannelFromOrderForm.test.ts (14 tests) 12ms
 stderr | test/components/search/SearchInputComponent.test.tsx
 Warning: forwardRef render functions accept exactly two parameters: props and ref. Did you forget to use the ref parameter?
 
@@ -460,25 +455,24 @@ Warning: React does not recognize the `providerProps` prop on a DOM element. If
     at Suspense
     at Wrapper (/home/runner/work/faststore/faststore/packages/core/test/components/search/SearchInputComponent.test.tsx:106:20)
 
- ✓  node  test/sdk/session/syncSalesChannelFromOrderForm.test.ts (14 tests) 15ms
- ✓  node  test/components/search/SearchInputComponent.test.tsx (6 tests) 72ms
- ✓  node  test/sdk/localization/bindingSelector.test.ts (18 tests) 9ms
- ✓  node  test/components/quotes/MyAccountListQuotesTable.test.tsx (15 tests) 500ms
- ✓  node  test/sdk/search/useSearchHistory.test.ts (13 tests) 50ms
+ ✓  node  test/sdk/localization/bindingSelector.test.ts (18 tests) 12ms
+ ✓  node  test/components/search/SearchInputComponent.test.tsx (6 tests) 94ms
+ ✓  node  test/components/quotes/MyAccountListQuotesTable.test.tsx (15 tests) 474ms
+ ✓  node  test/sdk/search/useSearchHistory.test.ts (13 tests) 48ms
 stderr | test/pages/pvt/account/cards/index.test.ts > Cards page getServerSideProps > redirects to /pvt/account/403 when the query fails with 401/403
 { extensions: { status: 401 } }
 
 stderr | test/pages/pvt/account/cards/index.test.ts > Cards page getServerSideProps > renders the error state (no redirect) when the query fails with a non-auth status
 { extensions: { status: 502 } }
 
- ✓  node  test/pages/pvt/account/cards/index.test.ts (8 tests) 8ms
- ✓  node  test/components/quotes/MyAccountListQuotes.test.tsx (11 tests) 854ms
-     ✓ navigates with the search term on blur  360ms
+ ✓  node  test/pages/pvt/account/cards/index.test.ts (8 tests) 11ms
+ ✓  node  test/components/quotes/MyAccountListQuotes.test.tsx (11 tests) 832ms
+     ✓ navigates with the search term on blur  358ms
      ✓ navigates without a label param when the search is cleared  360ms
- ✓  node  test/utils/cookieCacheBusting.test.ts (10 tests) 15ms
- ✓  node  test/components/quotes/quoteFilters.test.ts (26 tests) 34ms
- ✓  node  test/utils/productJsonLd.test.ts (36 tests) 16ms
- ✓  node  test/experimental/myAccountCmsServerSideProps.test.ts (5 tests) 11ms
+ ✓  node  test/components/quotes/quoteFilters.test.ts (26 tests) 29ms
+ ✓  node  test/utils/productJsonLd.test.ts (36 tests) 14ms
+ ✓  node  test/utils/cookieCacheBusting.test.ts (10 tests) 17ms
+ ✓  node  test/experimental/myAccountCmsServerSideProps.test.ts (5 tests) 22ms
 stderr | test/pages/api/graphql.test.ts > /api/graphql error status propagation > propagates the upstream 400 from a wrapped BadRequestError instead of 500
 Graphql execution returned with error:  [
   {
@@ -588,74 +582,73 @@ Warning: React does not recognize the `providerProps` prop on a DOM element. If
     at trace (file:///home/runner/work/faststore/faststore/node_modules/.pnpm/vitest@4.0.18_@opentelemetry+api@1.9.0_@types+node@20.19.13_jiti@2.6.1_jsdom@27.4.0_sas_13be941c57d55f08f06eeaf1c180ddfe/node_modules/vitest/dist/chunks/test.B8ej_ZHS.js:239:21)
     at runTest (file:///home/runner/work/faststore/faststore/node_modules/.pnpm/@vitest+runner@4.0.18/node_modules/@vitest/runner/dist/index.js:1653:12)
 
- ✓  node  test/pages/api/graphql.test.ts (19 tests) 35ms
- ✓  node  test/utils/clearCookies.test.ts (20 tests) 23ms
- ✓  node  test/utils/multipleTemplates.test.ts (8 tests) 8ms
+ ✓  node  test/pages/api/graphql.test.ts (19 tests) 31ms
+ ✓  node  test/utils/clearCookies.test.ts (20 tests) 28ms
+ ✓  node  test/utils/multipleTemplates.test.ts (8 tests) 5ms
 stderr | test/sdk/account/useSetPassword.test.ts > useSetPassword > maps wrongcredentials error responses to the existing message
 Set password request failed: Bad Request
 
- ✓  node  test/sdk/account/useSetPassword.test.ts (6 tests) 47ms
- ✓  node  test/sdk/orderEntry/useOrderEntryOperation.test.ts (8 tests) 34ms
- ✓  node  test/utils/localization/localizeRedirectDestination.test.ts (11 tests) 6ms
- ✓  node  test/components/quotes/MyAccountQuotesFilterSlider.test.tsx (8 tests) 170ms
- ✓  node  test/components/quotes/MyAccountQuotesStatusSelector.test.tsx (14 tests) 197ms
+ ✓  node  test/sdk/account/useSetPassword.test.ts (6 tests) 31ms
+ ✓  node  test/sdk/orderEntry/useOrderEntryOperation.test.ts (8 tests) 43ms
+ ✓  node  test/utils/localization/localizeRedirectDestination.test.ts (11 tests) 7ms
+ ✓  node  test/components/quotes/MyAccountQuotesFilterSlider.test.tsx (8 tests) 226ms
+ ✓  node  test/components/quotes/MyAccountQuotesStatusSelector.test.tsx (14 tests) 190ms
  ✓  node  test/utils/localization/hreflang.test.ts (8 tests) 7ms
- ✓  node  test/sdk/account/getMyAccountRoutes.test.ts (13 tests) 11ms
- ✓  node  test/components/quotes/MyAccountQuotesSelectedTags.test.tsx (10 tests) 155ms
- ✓  node  test/sdk/redirects/index.test.ts (7 tests) 45ms
- ✓  node  test/sdk/orderEntry/useOrderEntryUpload.test.ts (8 tests) 62ms
- ✓  node  test/proxy.localization.test.ts (5 tests) 76ms
- ✓  node  test/sdk/orderEntry/useOrderEntry.test.ts (8 tests) 50ms
- ✓  node  test/components/account/orders/getDeliveryOptionLabel.test.ts (21 tests) 9ms
- ✓  node  test/sdk/graphql/retryPolicy.test.ts (18 tests) 21ms
- ✓  node  test/server/cms/myAccountDefaultSections.test.ts (9 tests) 7ms
- ✓  node  test/utils/productJsonLdRendering.test.tsx (5 tests) 15ms
- ✓  node  test/sdk/analytics/useStartRecommendationSession.test.ts (6 tests) 33ms
- ✓  node  test/sdk/orderEntry/useOrderFormItems.test.ts (7 tests) 26ms
- ✓  node  test/proxy.test.ts (4 tests) 18ms
- ✓  node  test/server/webops-api.test.ts (9 tests) 12ms
- ✓  node  test/components/account/orders/StatusCard.test.ts (3 tests) 19ms
+ ✓  node  test/sdk/account/getMyAccountRoutes.test.ts (13 tests) 8ms
+ ✓  node  test/components/quotes/MyAccountQuotesSelectedTags.test.tsx (10 tests) 124ms
+ ✓  node  test/sdk/redirects/index.test.ts (7 tests) 51ms
+ ✓  node  test/sdk/orderEntry/useOrderEntryUpload.test.ts (8 tests) 58ms
+ ✓  node  test/proxy.localization.test.ts (5 tests) 35ms
+ ✓  node  test/sdk/orderEntry/useOrderEntry.test.ts (8 tests) 49ms
+ ✓  node  test/components/account/orders/getDeliveryOptionLabel.test.ts (21 tests) 7ms
+ ✓  node  test/sdk/graphql/retryPolicy.test.ts (18 tests) 23ms
+ ✓  node  test/server/cms/myAccountDefaultSections.test.ts (9 tests) 8ms
+ ✓  node  test/utils/productJsonLdRendering.test.tsx (5 tests) 12ms
+ ✓  node  test/utils/trustedForwardedHost.test.ts (27 tests) 8ms
+ ✓  node  test/server/index.test.ts (7 tests) 746ms
+ ✓  node  test/proxy.test.ts (4 tests) 23ms
+ ✓  node  test/server/webops-api.test.ts (9 tests) 14ms
  ✓  node  test/sdk/localization/store-url.test.ts (4 tests) 5ms
- ✓  node  test/sdk/cart/waitForSessionValidated.test.ts (5 tests) 12ms
- ✓  node  test/server/content/service.test.ts (5 tests) 5ms
- ✓  node  test/sdk/account/refreshToken.test.ts (5 tests) 6ms
- ✓  node  test/server/cms/global.test.ts (3 tests) 4ms
- ✓  node  test/sdk/auth/useAuth.test.ts (5 tests) 30ms
- ✓  node  test/server/rootSpan.test.ts (4 tests) 41ms
+ ✓  node  test/sdk/analytics/useStartRecommendationSession.test.ts (6 tests) 77ms
+ ✓  node  test/components/account/orders/StatusCard.test.ts (3 tests) 32ms
+ ✓  node  test/sdk/orderEntry/useOrderFormItems.test.ts (7 tests) 41ms
+ ✓  node  test/sdk/cart/waitForSessionValidated.test.ts (5 tests) 13ms
+ ✓  node  test/sdk/account/refreshToken.test.ts (5 tests) 12ms
+ ✓  node  test/server/content/service.test.ts (5 tests) 4ms
+ ✓  node  test/server/cms/global.test.ts (3 tests) 6ms
+ ✓  node  test/sdk/auth/useAuth.test.ts (5 tests) 44ms
  ✓  node  test/utils/getRequestHostname.test.ts (12 tests) 5ms
- ✓  node  test/pages/api/preview.test.ts (2 tests) 7ms
- ✓  node  test/components/account/Layout.test.tsx (6 tests) 49ms
- ✓  node  test/components/search/SearchInput.test.ts (6 tests) 7ms
- ✓  node  test/utils/validateSessionRefreshToken.test.ts (6 tests) 4ms
- ✓  node  test/server/index.test.ts (7 tests) 5149ms
-       ✓ should return a valid merged GraphQL schema  302ms
-       ✓ should handle options and execute  4558ms
+ ✓  node  test/components/account/Layout.test.tsx (6 tests) 77ms
+ ✓  node  test/server/rootSpan.test.ts (4 tests) 48ms
+ ✓  node  test/pages/api/preview.test.ts (2 tests) 9ms
+ ✓  node  test/components/search/SearchInput.test.ts (6 tests) 13ms
+ ✓  node  test/utils/validateSessionRefreshToken.test.ts (6 tests) 6ms
  ✓  node  test/sdk/recommendations/vrn.test.ts (5 tests) 6ms
- ✓  node  test/components/region/useRegion.test.ts (1 test) 29ms
- ✓  node  test/utils/retry.test.ts (5 tests) 16ms
- ✓  node  test/server/cms/index.test.ts (2 tests) 6ms
- ✓  node  test/sdk/account/getB2BSessionClaims.test.ts (4 tests) 4ms
- ✓  node  test/utils/userOrderStatus.test.ts (4 tests) 6ms
- ✓  node  test/sdk/recommendations/useRecommendationUserId.test.ts (4 tests) 187ms
+ ✓  node  test/components/region/useRegion.test.ts (1 test) 24ms
+ ✓  node  test/server/cms/index.test.ts (2 tests) 4ms
+ ✓  node  test/utils/retry.test.ts (5 tests) 17ms
+ ✓  node  test/sdk/account/getB2BSessionClaims.test.ts (4 tests) 7ms
+ ✓  node  test/sdk/recommendations/useRecommendationUserId.test.ts (4 tests) 194ms
+ ✓  node  test/utils/userOrderStatus.test.ts (4 tests) 5ms
  ✓  node  test/utils/unlockResponse.test.ts (11 tests) 5ms
  ✓  node  test/sdk/recommendations/useRecommendations.test.ts (2 tests) 6ms
- ✓  node  test/components/account/OrganizationDrawerBody.test.tsx (3 tests) 49ms
- ✓  node  test/utils/isLocalHost.test.ts (7 tests) 4ms
+ ✓  node  test/components/account/OrganizationDrawerBody.test.tsx (3 tests) 43ms
+ ✓  node  test/utils/isLocalHost.test.ts (7 tests) 5ms
  ✓  node  test/sdk/session/toSessionInput.test.ts (3 tests) 5ms
- ✓  node  test/components/quotes/MyAccountQuoteStatusBadge.test.tsx (4 tests) 37ms
- ✓  node  test/components/account/orders/getOrderTotalLabel.test.ts (6 tests) 5ms
+ ✓  node  test/components/quotes/MyAccountQuoteStatusBadge.test.tsx (4 tests) 49ms
+ ✓  node  test/components/account/orders/getOrderTotalLabel.test.ts (6 tests) 4ms
  ✓  node  test/components/account/orders/listOrdersLabels.test.ts (2 tests) 3ms
  ✓  node  test/utils/getCookie.test.ts (4 tests) 5ms
- ✓  node  test/sdk/session/isSignInAreaResolved.test.ts (3 tests) 5ms
- ✓  node  test/components/auth/ProfileChallenge.test.tsx (3 tests) 34ms
- ✓  node  test/utils/filterChannel.test.ts (2 tests) 5ms
- ✓  node  test/sdk/analytics/utils.test.ts (2 tests) 5ms
- ✓  node  test/instrumentation.test.ts (3 tests) 7ms
+ ✓  node  test/sdk/session/isSignInAreaResolved.test.ts (3 tests) 4ms
+ ✓  node  test/utils/filterChannel.test.ts (2 tests) 4ms
+ ✓  node  test/components/auth/ProfileChallenge.test.tsx (3 tests) 43ms
+ ✓  node  test/instrumentation.test.ts (3 tests) 5ms
+ ✓  node  test/sdk/analytics/utils.test.ts (2 tests) 3ms
  ✓  node  test/components/account/orders/orderDetailsLabels.test.ts (1 test) 4ms
- ✓  node  test/sdk/account/clearPersistedSessionState.test.ts (1 test) 10ms
+ ✓  node  test/sdk/account/clearPersistedSessionState.test.ts (1 test) 8ms
 
- Test Files  129 passed (129)
-      Tests  1005 passed (1005)
-   Start at  19:28:12
-   Duration  64.24s (transform 13.31s, setup 0ms, import 54.17s, tests 28.07s, environment 78.66s)
+ Test Files  130 passed (130)
+      Tests  1032 passed (1032)
+   Start at  00:35:08
+   Duration  62.92s (transform 13.32s, setup 0ms, import 56.50s, tests 21.42s, environment 78.13s)
 

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.9.3-dev.2](https://github.com/vtex/faststore/compare/v4.9.3-dev.1...v4.9.3-dev.2) (2026-10-07)
+
+### Bug Fixes
+
+- address security & functional concerns from dk review ([d0b6106](https://github.com/vtex/faststore/commit/d0b610688ec551d8105c74750927be4ab1af7224))
+- **core:** harden x-forwarded-host handling and drop orderNumber fallback ([c1faa35](https://github.com/vtex/faststore/commit/c1faa35fe070ff8b51d4f07a5f1f33da4b17d836)), closes [#3178](https://github.com/vtex/faststore/issues/3178)
+- **core:** ignore multi-value x-forwarded-host and cover port and case ([b81d5d9](https://github.com/vtex/faststore/commit/b81d5d91721f9f8205251ad39e607b094386083c))
+- **core:** log ignored x-forwarded-host and cover CR/LF hostnames ([adaa816](https://github.com/vtex/faststore/commit/adaa81608b7e72759272e1d6d23ca6257b9a4d59))
+- **core:** make preview cookies host-only instead of rewriting their domain ([8e4901e](https://github.com/vtex/faststore/commit/8e4901ec7d127336bc27c0ae8e52c9cadea1a5a3))
+- **core:** reject hostnames that would inject Set-Cookie attributes ([059a437](https://github.com/vtex/faststore/commit/059a4377c3b1b8f66aeed2b73ce130e1ab827f77))
+- resolve ValidateCartMutation infinite loop in preview environments (SFS-3034) ([1cc9a5e](https://github.com/vtex/faststore/commit/1cc9a5efb1617f3d032623c4ee5f687ad5e2ccd9)), closes [#3178](https://github.com/vtex/faststore/issues/3178) [#3178](https://github.com/vtex/faststore/issues/3178) [#3190](https://github.com/vtex/faststore/issues/3190) [#3188](https://github.com/vtex/faststore/issues/3188) [#1467584](https://github.com/vtex/faststore/issues/1467584)
+
 ## [4.9.3-dev.1](https://github.com/vtex/faststore/compare/v4.9.3-dev.0...v4.9.3-dev.1) (2026-10-06)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "4.9.3-dev.1",
+  "version": "4.9.3-dev.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -71,11 +71,11 @@
     "style-loader": "^3.3.1",
     "swr": "^2.2.5",
     "use-sync-external-store": "^1.6.0",
-    "@faststore/api": "4.9.3-dev.1",
-    "@faststore/diagnostics": "4.9.3-dev.1",
-    "@faststore/lighthouse": "4.9.3-dev.1",
-    "@faststore/sdk": "4.9.3-dev.1",
-    "@faststore/ui": "4.9.3-dev.1"
+    "@faststore/api": "4.9.3-dev.2",
+    "@faststore/diagnostics": "4.9.3-dev.2",
+    "@faststore/lighthouse": "4.9.3-dev.2",
+    "@faststore/sdk": "4.9.3-dev.2",
+    "@faststore/ui": "4.9.3-dev.2"
   },
   "devDependencies": {
     "@cypress/code-coverage": "^3.12.1",

package/src/pages/api/graphql.ts

@@ -11,6 +11,11 @@ import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
 import { isLocalHost } from 'src/utils/isLocalHost'
+import {
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 import { logger } from '@faststore/diagnostics'
@@ -56,22 +61,10 @@ const shouldReplaceCookieDomain = ({
 }
 
 /**
- * Determines if host is eligible for domain normalization.
- */
-const isAllowedHost = ({
-  host,
-  allowList,
-}: {
-  host: string
-  allowList: string[]
-}) => {
-  const normalizedHost = host.toLowerCase()
-
-  return allowList.some((suffix) => normalizedHost.endsWith(suffix))
-}
-
-/**
- * Ensure the cookie domain matches the current host so the browser can store it.
+ * On allowlisted hosts (previews, localhost) the upstream cookie domain does not
+ * match the browser host, so the Domain attribute is dropped and the cookie
+ * becomes host-only. The host is never written into the cookie, so a forged
+ * x-forwarded-host cannot choose the cookie scope.
  */
 const normalizeSetCookieDomain = ({
   request,
@@ -85,20 +78,31 @@ const normalizeSetCookieDomain = ({
     return setCookie
   }
 
-  const host = getRequestHostname(request.headers.host)
+  // The preview ingress forwards a client-supplied x-forwarded-host as is, so
+  // it only decides whether the Domain is dropped, never which domain is used.
+  const forwardedHeader = request.headers['x-forwarded-host']
+  const forwardedHost = getRequestHostname(singleForwardedHost(forwardedHeader))
+  if (forwardedHeader && !forwardedHost) {
+    // The value is client-controllable, so it is not logged.
+    OTELLogger('warn', 'Ignoring multi-value or malformed x-forwarded-host')
+  }
+  const host =
+    forwardedHost && isHostAllowed(forwardedHost, ALLOWED_HOST_SUFFIXES)
+      ? forwardedHost
+      : getRequestHostname(request.headers.host)
   if (!host) {
     return setCookie
   }
   const cookieDomain = domainMatch[1]
 
   if (
-    !isAllowedHost({ host, allowList: ALLOWED_HOST_SUFFIXES }) ||
+    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
   }
 
-  return setCookie.replace(MATCH_DOMAIN_REGEXP, `; domain=${host}`)
+  return removeCookieDomain(setCookie)
 }
 
 const parseRequest = (request: NextApiRequest) => {

package/src/utils/trustedForwardedHost.ts

@@ -0,0 +1,50 @@
+// The result is written verbatim into a Set-Cookie Domain attribute, so
+// characters such as ";" or spaces would inject cookie attributes.
+const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
+
+/**
+ * An entry starting with "." matches subdomains only; any other entry matches
+ * the host itself and its subdomains. Matching is anchored on a label boundary,
+ * so "evil-localhost" never matches "localhost".
+ */
+export function isHostAllowed(host: string, allowList: string[]) {
+  const normalizedHost = host.toLowerCase()
+
+  if (!HOSTNAME_PATTERN.test(normalizedHost)) {
+    return false
+  }
+
+  return allowList.some((entry) =>
+    entry.startsWith('.')
+      ? normalizedHost.endsWith(entry)
+      : normalizedHost === entry || normalizedHost.endsWith(`.${entry}`)
+  )
+}
+
+/**
+ * Returns the `x-forwarded-host` value only when exactly one is present.
+ *
+ * Which hop of a proxy chain is trustworthy is not known here: with several
+ * values the leftmost one is whatever the client sent. So a multi-value header
+ * (comma-joined by Node, or an array) is ignored and the caller falls back to
+ * `host`. A single value still assumes the ingress overwrites the header.
+ */
+export function singleForwardedHost(
+  header: string | string[] | undefined
+): string | undefined {
+  if (Array.isArray(header)) {
+    return header.length === 1 ? singleForwardedHost(header[0]) : undefined
+  }
+
+  const value = header?.trim()
+
+  return value && !value.includes(',') ? value : undefined
+}
+
+/**
+ * Drops every Domain attribute so the cookie becomes host-only: the browser
+ * scopes it to the exact host it requested, whatever header picked this path.
+ */
+export function removeCookieDomain(setCookie: string): string {
+  return setCookie.replaceAll(/;\s*domain=[^;]*/gi, '')
+}

package/test/utils/trustedForwardedHost.test.ts

@@ -0,0 +1,105 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  singleForwardedHost,
+  isHostAllowed,
+  removeCookieDomain,
+} from '../../src/utils/trustedForwardedHost'
+
+const ALLOW_LIST = ['localhost', '.vtex.app', '.localhost']
+
+describe('isHostAllowed', () => {
+  it.each([
+    'localhost',
+    'store.vtex.app',
+    'sfj-1--acc.preview.vtex.app',
+    'a.localhost',
+  ])('allows %s', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'evil-localhost',
+    'notlocalhost',
+    'evil-vtex.app',
+    'vtex.app.evil.com',
+    'evil.com',
+  ])('rejects %s', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('isHostAllowed normalization', () => {
+  it('is case-insensitive', () => {
+    expect(isHostAllowed('Store.VTEX.app', ALLOW_LIST)).toBe(true)
+    expect(isHostAllowed('LOCALHOST', ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'x;max-age=0;y.vtex.app',
+    'a b.vtex.app',
+    'x"y.vtex.app',
+    'x=y.vtex.app',
+    'x,y.vtex.app',
+    'x\r\nSet-Cookie: evil=1.vtex.app',
+    'x\ny.vtex.app',
+    'x\ry.vtex.app',
+  ])('rejects %s, which would inject cookie attributes', (host) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+
+  it('accepts punycode hostnames', () => {
+    expect(isHostAllowed('xn--lja-bma.vtex.app', ALLOW_LIST)).toBe(true)
+  })
+
+  it('expects a hostname: a port is not stripped here', () => {
+    expect(isHostAllowed('store.vtex.app:8080', ALLOW_LIST)).toBe(false)
+    expect(isHostAllowed('evil.com:vtex.app', ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('singleForwardedHost', () => {
+  it('returns the value when there is exactly one', () => {
+    expect(singleForwardedHost('a.vtex.app')).toBe('a.vtex.app')
+    expect(singleForwardedHost(' a.vtex.app ')).toBe('a.vtex.app')
+    expect(singleForwardedHost(['a.vtex.app'])).toBe('a.vtex.app')
+  })
+
+  it('returns undefined when missing or empty', () => {
+    expect(singleForwardedHost(undefined)).toBeUndefined()
+    expect(singleForwardedHost('')).toBeUndefined()
+    expect(singleForwardedHost([])).toBeUndefined()
+  })
+
+  it('ignores multi-value headers instead of picking one', () => {
+    expect(singleForwardedHost('a.vtex.app, evil.com')).toBeUndefined()
+    expect(singleForwardedHost('evil.com, a.vtex.app')).toBeUndefined()
+    expect(singleForwardedHost(['a.vtex.app', 'evil.com'])).toBeUndefined()
+  })
+})
+
+describe('removeCookieDomain', () => {
+  it('drops the Domain attribute and keeps the rest', () => {
+    expect(
+      removeCookieDomain(
+        'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; domain=acc.vtexcommercestable.com.br; path=/; secure; samesite=lax; httponly'
+      )
+    ).toBe(
+      'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; path=/; secure; samesite=lax; httponly'
+    )
+  })
+
+  it('is case-insensitive and removes repeated Domain attributes', () => {
+    expect(removeCookieDomain('a=1; Domain=x.com; DOMAIN=y.com; Path=/')).toBe(
+      'a=1; Path=/'
+    )
+  })
+
+  it('does not touch a cookie whose name is domain', () => {
+    expect(removeCookieDomain('domain=1; path=/')).toBe('domain=1; path=/')
+  })
+
+  it('keeps cookies without a Domain attribute unchanged', () => {
+    expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
+  })
+})