@decocms/apps-vtex 7.2.0

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@decocms/apps-vtex",
+  "version": "7.2.0",
+  "type": "module",
+  "description": "Deco commerce app: VTEX integration",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/decocms/blocks.git",
+    "directory": "packages/apps-vtex"
+  },
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./commerceLoaders": "./src/commerceLoaders.ts",
+    "./mod": "./src/mod.ts",
+    "./client": "./src/client.ts",
+    "./types": "./src/types.ts",
+    "./actions": "./src/actions/index.ts",
+    "./actions/*": "./src/actions/*.ts",
+    "./actions/analytics/*": "./src/actions/analytics/*.ts",
+    "./loaders": "./src/loaders/index.ts",
+    "./loaders/*": "./src/loaders/*.ts",
+    "./utils": "./src/utils/index.ts",
+    "./utils/*": "./src/utils/*.ts",
+    "./loaders/intelligentSearch/*": "./src/loaders/intelligentSearch/*.ts",
+    "./loaders/legacy/*": "./src/loaders/legacy/*.ts",
+    "./loaders/workflow/*": "./src/loaders/workflow/*.ts",
+    "./inline-loaders/productDetailsPage": "./src/loaders/intelligentSearch/productDetailsPage.ts",
+    "./inline-loaders/productListingPage": "./src/loaders/intelligentSearch/productListingPage.ts",
+    "./inline-loaders/productList": "./src/loaders/productListFull.ts",
+    "./inline-loaders/productListShelf": "./src/loaders/intelligentSearch/productList.ts",
+    "./inline-loaders/relatedProducts": "./src/loaders/legacy/relatedProductsLoader.ts",
+    "./inline-loaders/suggestions": "./src/loaders/intelligentSearch/suggestions.ts",
+    "./inline-loaders/minicart": "./src/loaders/minicart.ts",
+    "./inline-loaders/workflowProducts": "./src/loaders/workflow/products.ts",
+    "./hooks": "./src/hooks/index.ts",
+    "./hooks/*": "./src/hooks/*.ts",
+    "./middleware": "./src/middleware.ts",
+    "./registry": "./src/registry.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run --root ../.. packages/apps-vtex/",
+    "typecheck": "tsc --noEmit",
+    "lint:unused": "knip"
+  },
+  "dependencies": {
+    "@decocms/blocks": "7.2.0",
+    "@decocms/apps-commerce": "7.2.0",
+    "@decocms/apps-website": "7.2.0",
+    "@decocms/tanstack": "7.2.0"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "knip": "^5.86.0",
+    "typescript": "^5.9.0"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}

package/src/README.md

@@ -0,0 +1,6 @@
+VTEX is a cloud-based e-commerce platform and digital commerce company that provides a comprehensive set of tools and services for businesses looking to establish and manage their online retail operations.
+
+This app wrapps VTEX API into a comprehensive set of loaders/actions/workflows
+empowering non technical users to interact and act upon their headless commerce.
+
+If you want to use a custom search engine (Algolia, Typesense etc), you will need to fill the App Key & App Token properties. For these, follow this guide

package/src/__tests__/client-segment-cookie.test.ts

@@ -0,0 +1,255 @@
+/**
+ * Regression tests for the auto-forwarding of `vtex_segment` on outgoing
+ * VTEX API calls. Without this, Legacy Catalog endpoints don't see the
+ * region cookie and return OutOfStock for products only available
+ * through regional sellers — see vtex/client.ts:vtexFetchResponse.
+ */
+
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+	configureVtex,
+	intelligentSearch,
+	setVtexFetch,
+	vtexCachedFetch,
+	vtexFetchResponse,
+} from "../client";
+import { clearFetchCache } from "../utils/fetchCache";
+
+function mockResponse(body: unknown = {}, status = 200): Response {
+	return {
+		ok: status >= 200 && status < 300,
+		status,
+		statusText: status === 200 ? "OK" : "Error",
+		json: () => Promise.resolve(body),
+	} as Response;
+}
+
+/**
+ * Run `fn` inside a fake request context with the given cookie header.
+ *
+ * Two problems prevented a naive `RequestContext.run(new Request(...))`
+ * approach from working:
+ *
+ *  1. Under the Fetch spec a Request's headers are in the "request"
+ *     guard mode, which silently drops forbidden request headers —
+ *     including `cookie` — at construction time. Node 22 / undici
+ *     enforces this strictly, so the cookie never reaches
+ *     `request.headers.get("cookie")`.
+ *  2. `@decocms/start`'s `RequestContext` is backed by a
+ *     `RequestStore` that defaults to a NOOP implementation. The
+ *     ALS-backed store is installed by site code at worker boot, not
+ *     in unit tests. So `RequestContext.run(req, fn)` calls
+ *     `fn()` without any propagation, and `RequestContext.current`
+ *     inside `fn` still returns `null` — production code under test
+ *     never sees the test's cookie.
+ *
+ * Fix: build a fresh `Headers` object (which uses the "none" guard,
+ * so `set("cookie", ...)` works), wrap it in a minimal `Ctx`-shaped
+ * object, and override the `RequestContext.current` getter via
+ * `vi.spyOn`. The spy is restored after `fn` resolves to keep tests
+ * isolated. Nothing here depends on undici or ALS internals.
+ */
+/**
+ * Read a header from an init in a shape-agnostic way. After the
+ * `mergeHeaders` refactor, `init.headers` is always a `Headers`
+ * instance — but the helper handles legacy shapes too so the tests
+ * stay robust if someone changes the merge implementation again.
+ */
+function headerValue(init: RequestInit | undefined, name: string): string | undefined {
+	const headers = init?.headers;
+	if (!headers) return undefined;
+	if (headers instanceof Headers) return headers.get(name) ?? undefined;
+	if (Array.isArray(headers)) {
+		const found = headers.find(([k]) => k.toLowerCase() === name.toLowerCase());
+		return found?.[1];
+	}
+	const rec = headers as Record<string, string>;
+	const key = Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+	return key ? rec[key] : undefined;
+}
+
+function withRequest<T>(cookieHeader: string | null, fn: () => Promise<T>): Promise<T> {
+	const headers = new Headers();
+	if (cookieHeader) headers.set("cookie", cookieHeader);
+	const fakeCtx = {
+		request: { headers } as unknown as Request,
+		signal: new AbortController().signal,
+		responseHeaders: new Headers(),
+		bag: new Map(),
+		startedAt: Date.now(),
+	};
+	const spy = vi
+		.spyOn(RequestContext, "current", "get")
+		.mockReturnValue(fakeCtx as unknown as ReturnType<typeof Reflect.get>);
+	return fn().finally(() => spy.mockRestore());
+}
+
+describe("vtexFetchResponse — vtex_segment cookie forwarding", () => {
+	let lastInit: RequestInit | undefined;
+
+	beforeEach(() => {
+		configureVtex({ account: "testaccount" });
+		lastInit = undefined;
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(mockResponse());
+		}) as typeof fetch);
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("forwards vtex_segment cookie when present and caller didn't set one", async () => {
+		await withRequest("vtex_segment=abc123; other=foo", async () => {
+			await vtexFetchResponse("/api/catalog_system/pub/products/x");
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("vtex_segment=abc123");
+	});
+
+	it("does not overwrite a caller-supplied cookie header", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			await vtexFetchResponse("/api/x", {
+				headers: { cookie: "custom=zzz" },
+			});
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("custom=zzz");
+	});
+
+	it("does not overwrite a caller-supplied Cookie header (case-insensitive)", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			await vtexFetchResponse("/api/x", {
+				headers: { Cookie: "custom=zzz" },
+			});
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("custom=zzz");
+	});
+
+	it("is a no-op when there is no incoming cookie header", async () => {
+		await withRequest(null, async () => {
+			await vtexFetchResponse("/api/x");
+		});
+		expect(headerValue(lastInit, "cookie")).toBeUndefined();
+	});
+
+	it("is a no-op when there is a cookie header but no vtex_segment", async () => {
+		await withRequest("other=foo; another=bar", async () => {
+			await vtexFetchResponse("/api/x");
+		});
+		expect(headerValue(lastInit, "cookie")).toBeUndefined();
+	});
+
+	it("does not crash when called outside a RequestContext", async () => {
+		await vtexFetchResponse("/api/x");
+		expect(headerValue(lastInit, "cookie")).toBeUndefined();
+	});
+
+	it("preserves auth headers alongside the forwarded cookie", async () => {
+		configureVtex({ account: "testaccount", appKey: "k", appToken: "t" });
+		await withRequest("vtex_segment=abc123", async () => {
+			await vtexFetchResponse("/api/x");
+		});
+		expect(headerValue(lastInit, "X-VTEX-API-AppKey")).toBe("k");
+		expect(headerValue(lastInit, "X-VTEX-API-AppToken")).toBe("t");
+		expect(headerValue(lastInit, "cookie")).toBe("vtex_segment=abc123");
+	});
+
+	// Regression: when init.headers is a Headers object (as
+	// `createVtexCheckoutProxy` passes through `getVtexFetch()`), the
+	// existing cookie must survive verbatim. The naive
+	// `{ ...authHeaders, ...init?.headers }` spread collapses a Headers
+	// instance to `{}` (Headers has no own enumerable entries), which
+	// silently wipes the browser's full Cookie header — including the
+	// orderForm cookie any checkout flow depends on.
+	it("preserves an existing Cookie header when init.headers is a Headers instance", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			const proxyInit: RequestInit = {
+				headers: new Headers({
+					cookie: "checkout.vtex.com=__ofid=xyz; vtex_segment=originalseg; foo=bar",
+				}),
+			};
+			await vtexFetchResponse("/api/checkout/pub/orderForm", proxyInit);
+		});
+		expect(headerValue(lastInit, "cookie")).toContain("checkout.vtex.com=__ofid=xyz");
+	});
+});
+
+// Module-level counter for cache-busting test URLs. `Date.now()` collides
+// when two tests run within the same millisecond and the SWR cache in
+// fetchWithCache short-circuits the second one — `_fetch` never runs and
+// `lastInit` stays `undefined`. Per-test ids are deterministic and
+// collision-free.
+let testUrlCounter = 0;
+const uniqPath = (prefix: string) => `${prefix}/${++testUrlCounter}`;
+
+describe("vtexCachedFetch — vtex_segment cookie forwarding", () => {
+	let lastInit: RequestInit | undefined;
+
+	beforeEach(() => {
+		clearFetchCache();
+		configureVtex({ account: "testaccount" });
+		lastInit = undefined;
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(mockResponse({ ok: true }));
+		}) as typeof fetch);
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("forwards vtex_segment on cached GETs", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			await vtexCachedFetch(uniqPath("/api/catalog_system/pub/products"));
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("vtex_segment=abc123");
+	});
+
+	it("does not overwrite a caller-supplied cookie header", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			await vtexCachedFetch(uniqPath("/api/x"), {
+				headers: { cookie: "custom=zzz" },
+			});
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("custom=zzz");
+	});
+});
+
+describe("intelligentSearch — vtex_segment cookie forwarding", () => {
+	let lastInit: RequestInit | undefined;
+
+	beforeEach(() => {
+		// Reset the SWR cache: otherwise the second test in this block
+		// can serve the first test's cached body without invoking the
+		// stub _fetch, leaving lastInit undefined.
+		clearFetchCache();
+		configureVtex({ account: "testaccount" });
+		lastInit = undefined;
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(mockResponse({ products: [] }));
+		}) as typeof fetch);
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("forwards vtex_segment when caller didn't pass cookieHeader", async () => {
+		await withRequest("vtex_segment=abc123; other=foo", async () => {
+			await intelligentSearch(uniqPath("/product_search"));
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("vtex_segment=abc123");
+	});
+
+	it("respects an explicit cookieHeader override", async () => {
+		await withRequest("vtex_segment=abc123", async () => {
+			await intelligentSearch(uniqPath("/product_search"), undefined, {
+				cookieHeader: "custom=zzz",
+			});
+		});
+		expect(headerValue(lastInit, "cookie")).toBe("custom=zzz");
+	});
+});

package/src/__tests__/client-set-cookie-forward.test.ts

@@ -0,0 +1,257 @@
+/**
+ * Regression tests for the Set-Cookie propagation chain through
+ * `vtexFetchWithCookies`. Without this chain, VTEX's `checkout.vtex.com`
+ * and `CheckoutOrderFormOwnership` cookies never reach the browser via
+ * `createServerFn` actions, the storefront's local `__orderFormId`
+ * drifts away from VTEX's server-side orderForm, and the user lands
+ * on `/checkout` with an empty cart.
+ *
+ * Two failure modes covered here:
+ *
+ *  (1) Inbound capture — VTEX `Set-Cookie` headers must be appended
+ *      to `RequestContext.responseHeaders`, skipping the two IS
+ *      cookies that the middleware owns (`vtex_is_session`,
+ *      `vtex_is_anonymous`), and the `domain=` attribute must be
+ *      stripped so the browser scopes the cookie to the storefront.
+ *
+ *  (2) Outbound merge — when the caller passes `init.headers` as a
+ *      `Headers` instance (the `createVtexCheckoutProxy` factory does
+ *      this through `getVtexFetch()`), spreading it as a plain object
+ *      collapses to `{}` and silently wipes every other header the
+ *      caller set. The Headers-aware merge in `vtexFetchWithCookies`
+ *      keeps the bug from sneaking back in.
+ */
+
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { configureVtex, setVtexFetch, vtexFetchWithCookies } from "../client";
+
+function mockResponse(opts?: { body?: unknown; status?: number; setCookies?: string[] }): Response {
+	const status = opts?.status ?? 200;
+	const headers = new Headers();
+	for (const c of opts?.setCookies ?? []) headers.append("set-cookie", c);
+	return {
+		ok: status >= 200 && status < 300,
+		status,
+		statusText: status === 200 ? "OK" : "Error",
+		headers,
+		json: () => Promise.resolve(opts?.body ?? {}),
+	} as Response;
+}
+
+function headerValue(init: RequestInit | undefined, name: string): string | undefined {
+	const headers = init?.headers;
+	if (!headers) return undefined;
+	if (headers instanceof Headers) return headers.get(name) ?? undefined;
+	if (Array.isArray(headers)) {
+		const found = headers.find(([k]) => k.toLowerCase() === name.toLowerCase());
+		return found?.[1];
+	}
+	const rec = headers as Record<string, string>;
+	const key = Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+	return key ? rec[key] : undefined;
+}
+
+function withRequest<T>(
+	cookieHeader: string | null,
+	fn: (ctx: { responseHeaders: Headers }) => Promise<T>,
+	requestUrl = "https://store.example.com/api/checkout/pub/orderForm",
+): Promise<T> {
+	const reqHeaders = new Headers();
+	if (cookieHeader) reqHeaders.set("cookie", cookieHeader);
+	const responseHeaders = new Headers();
+	const fakeCtx = {
+		request: { headers: reqHeaders, url: requestUrl } as unknown as Request,
+		signal: new AbortController().signal,
+		responseHeaders,
+		bag: new Map(),
+		startedAt: Date.now(),
+	};
+	const spy = vi
+		.spyOn(RequestContext, "current", "get")
+		.mockReturnValue(fakeCtx as unknown as ReturnType<typeof Reflect.get>);
+	return fn({ responseHeaders }).finally(() => spy.mockRestore());
+}
+
+describe("vtexFetchWithCookies — inbound Set-Cookie capture", () => {
+	let lastInit: RequestInit | undefined;
+
+	beforeEach(() => {
+		configureVtex({ account: "testaccount" });
+		lastInit = undefined;
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("captures upstream Set-Cookie into RequestContext.responseHeaders", async () => {
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(
+				mockResponse({
+					setCookies: [
+						"checkout.vtex.com=__ofid=abc123; Path=/; HttpOnly; Secure",
+						"CheckoutOrderFormOwnership=def456; Path=/; HttpOnly",
+					],
+				}),
+			);
+		}) as typeof fetch);
+
+		const captured = await withRequest("vtex_segment=seg1", async ({ responseHeaders }) => {
+			await vtexFetchWithCookies("/api/checkout/pub/orderForm");
+			return responseHeaders.getSetCookie();
+		});
+
+		expect(captured).toHaveLength(2);
+		expect(captured.some((c) => c.startsWith("checkout.vtex.com="))).toBe(true);
+		expect(captured.some((c) => c.startsWith("CheckoutOrderFormOwnership="))).toBe(true);
+	});
+
+	// The cart server-fn cookie MUST land at the same scope as the checkout
+	// proxy (domain-scoped to the storefront host) and native VTEX
+	// (`domain=<host>`). Stripping the Domain (host-only) creates a second,
+	// distinct cookie that drifts from the proxy's and causes the
+	// nondeterministic empty-cart bug. So we rewrite Domain, not strip it.
+	it("rewrites the Domain= attribute to the storefront host (matches the proxy)", async () => {
+		setVtexFetch((() =>
+			Promise.resolve(
+				mockResponse({
+					setCookies: [
+						"checkout.vtex.com=__ofid=abc; Domain=.vtexcommercestable.com.br; Path=/; HttpOnly",
+					],
+				}),
+			)) as typeof fetch);
+
+		const captured = await withRequest(
+			"foo=bar",
+			async ({ responseHeaders }) => {
+				await vtexFetchWithCookies("/api/checkout/pub/orderForm");
+				return responseHeaders.getSetCookie();
+			},
+			"https://www.casaevideo.com.br/api/checkout/pub/orderForm",
+		);
+
+		// domain-scoped to the storefront host, NOT the original VTEX domain
+		expect(captured[0]).toMatch(/Domain=www\.casaevideo\.com\.br/);
+		expect(captured[0]).not.toMatch(/vtexcommercestable/i);
+		expect(captured[0]).toContain("checkout.vtex.com=__ofid=abc");
+	});
+
+	it("rewrites only the Domain attribute, not a domain= substring in the cookie value", async () => {
+		setVtexFetch((() =>
+			Promise.resolve(
+				mockResponse({
+					// Pathological value embedding `domain=` before the first `;`.
+					setCookies: [
+						"checkout.vtex.com=__ofid=domain=keep; Domain=.vtexcommercestable.com.br; Path=/",
+					],
+				}),
+			)) as typeof fetch);
+
+		const captured = await withRequest(
+			"foo=bar",
+			async ({ responseHeaders }) => {
+				await vtexFetchWithCookies("/api/checkout/pub/orderForm");
+				return responseHeaders.getSetCookie();
+			},
+			"https://www.casaevideo.com.br/api/checkout/pub/orderForm",
+		);
+
+		// the value's `domain=keep` is untouched; the attribute is rewritten
+		expect(captured[0]).toContain("__ofid=domain=keep");
+		expect(captured[0]).toMatch(/;\s*Domain=www\.casaevideo\.com\.br/);
+		expect(captured[0]).not.toMatch(/vtexcommercestable/i);
+	});
+
+	it("falls back to stripping Domain when there is no request scope (module init)", async () => {
+		setVtexFetch((() =>
+			Promise.resolve(
+				mockResponse({
+					setCookies: ["checkout.vtex.com=__ofid=abc; Domain=.vtexcommercestable.com.br; Path=/"],
+				}),
+			)) as typeof fetch);
+		// No withRequest wrapper → RequestContext.current is null.
+		await expect(vtexFetchWithCookies("/api/checkout/pub/orderForm")).resolves.toBeDefined();
+	});
+
+	it("skips Intelligent Search cookies (managed by middleware, not actions)", async () => {
+		setVtexFetch((() =>
+			Promise.resolve(
+				mockResponse({
+					setCookies: [
+						"checkout.vtex.com=__ofid=abc; Path=/",
+						"vtex_is_session=ignore-me; Path=/",
+						"vtex_is_anonymous=ignore-me-too; Path=/",
+						"CheckoutOrderFormOwnership=def; Path=/",
+					],
+				}),
+			)) as typeof fetch);
+
+		const captured = await withRequest("foo=bar", async ({ responseHeaders }) => {
+			await vtexFetchWithCookies("/api/checkout/pub/orderForm");
+			return responseHeaders.getSetCookie();
+		});
+
+		expect(captured.some((c) => c.startsWith("checkout.vtex.com="))).toBe(true);
+		expect(captured.some((c) => c.startsWith("CheckoutOrderFormOwnership="))).toBe(true);
+		expect(captured.some((c) => c.startsWith("vtex_is_session="))).toBe(false);
+		expect(captured.some((c) => c.startsWith("vtex_is_anonymous="))).toBe(false);
+	});
+
+	it("does not crash when called outside a RequestContext", async () => {
+		setVtexFetch((() =>
+			Promise.resolve(
+				mockResponse({
+					setCookies: ["checkout.vtex.com=__ofid=abc; Path=/"],
+				}),
+			)) as typeof fetch);
+		await expect(vtexFetchWithCookies("/api/checkout/pub/orderForm")).resolves.toBeDefined();
+	});
+
+	// Regression for Hole B: when init.headers is a Headers instance,
+	// the previous Record-cast + spread collapsed it to `{}`, wiping
+	// every other header (auth, content-type) the caller set. After
+	// the fix, the Headers-aware merge preserves all of them.
+	it("preserves other caller headers when init.headers is a Headers instance", async () => {
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(mockResponse());
+		}) as typeof fetch);
+
+		await withRequest("vtex_segment=abc; foo=bar", async () => {
+			await vtexFetchWithCookies("/api/checkout/pub/orderForm", {
+				headers: new Headers({
+					"X-Custom-Trace": "trace-id",
+					"X-VTEX-Operation": "test-op",
+				}),
+			});
+		});
+
+		expect(headerValue(lastInit, "x-custom-trace")).toBe("trace-id");
+		expect(headerValue(lastInit, "x-vtex-operation")).toBe("test-op");
+		// Caller didn't pass a Cookie — auto-injection picks up the
+		// request's cookie and forwards it without dropping the
+		// other headers.
+		expect(headerValue(lastInit, "cookie")).toBeDefined();
+	});
+
+	it("preserves an existing Cookie header passed via Headers and sanitises it in place", async () => {
+		setVtexFetch(((_url: string, init?: RequestInit) => {
+			lastInit = init;
+			return Promise.resolve(mockResponse());
+		}) as typeof fetch);
+
+		await withRequest("vtex_segment=abc", async () => {
+			await vtexFetchWithCookies("/api/checkout/pub/orderForm", {
+				headers: new Headers({
+					"X-Custom": "keep-me",
+					cookie: "checkout.vtex.com=__ofid=xyz; vtex_segment=mine",
+				}),
+			});
+		});
+
+		expect(headerValue(lastInit, "x-custom")).toBe("keep-me");
+		expect(headerValue(lastInit, "cookie")).toContain("checkout.vtex.com=__ofid=xyz");
+	});
+});