@decocms/apps 1.6.3 → 1.6.5

package/commerce/components/Image.tsx

@@ -103,8 +103,9 @@ export function getOptimizedMediaUrl(opts: OptimizationOptions): string {
 	let imageSource = originalSrc.replace(DECO_CACHE_URL, "").replace(S3_URL, "").split("?")[0];
 
 	// Already on the image CDN — strip the host so we don't proxy through ourselves.
-	if (imageSource.startsWith(`https://${imageCdnDomain}/`)) {
-		imageSource = imageSource.slice(`https://${imageCdnDomain}`.length);
+	const cdnPrefix = `https://${imageCdnDomain}/`;
+	if (imageSource.startsWith(cdnPrefix)) {
+		imageSource = imageSource.slice(cdnPrefix.length);
 	}
 
 	const params = new URLSearchParams();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/apps",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "type": "module",
   "description": "Deco commerce apps for TanStack Start - Shopify, VTEX, commerce types, analytics utils",
   "exports": {
@@ -116,7 +116,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.7",
-    "@decocms/start": "^0.38.0",
+    "@decocms/start": "^2.5.0",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
     "@tanstack/react-query": "^5.90.21",

package/vtex/client.ts

@@ -9,22 +9,15 @@ import { ANONYMOUS_COOKIE, SESSION_COOKIE } from "./utils/intelligentSearch";
 import { parseSegment, SEGMENT_COOKIE_NAME } from "./utils/segment";
 
 /**
- * Get the response headers from RequestContext.
- * Uses `responseHeaders` when available (@decocms/start PR#57),
- * falls back to the bag with a lazily-created Headers instance.
- * TODO: Remove fallback once @decocms/start PR#57 is published.
+ * Outgoing response headers for the active request, or `null` when
+ * called outside a request scope (which happens during module init).
+ * `RequestContext.responseHeaders` was added to `@decocms/start` in
+ * v0.39.0; we now require >=2.5.0 as a devDep so the property is
+ * always typed/present.
  */
 function getResponseHeaders(): Headers | null {
 	const ctx = RequestContext.current;
-	if (!ctx) return null;
-	// biome-ignore lint/suspicious/noExplicitAny: forward-compat with upcoming responseHeaders property
-	if ((ctx as any).responseHeaders instanceof Headers) return (ctx as any).responseHeaders;
-	let headers = ctx.bag.get("responseHeaders") as Headers | undefined;
-	if (!headers) {
-		headers = new Headers();
-		ctx.bag.set("responseHeaders", headers);
-	}
-	return headers;
+	return ctx ? ctx.responseHeaders : null;
 }
 
 // ---------------------------------------------------------------------------
@@ -175,12 +168,55 @@ function extractRegionIdFromCookies(): string | null {
 	return segment?.regionId ?? null;
 }
 
+/**
+ * Read the raw `vtex_segment=<token>` cookie from the active request.
+ * Returns null when outside a request context or no segment cookie is set.
+ *
+ * Used to forward the segment cookie on outgoing VTEX API calls so
+ * Legacy Catalog endpoints (which gate on the cookie, not on
+ * `?regionId=` query params) see the right region for products
+ * available only through regional sellers.
+ */
+function getSegmentCookieHeader(): string | null {
+	const ctx = RequestContext.current;
+	if (!ctx) return null;
+	const cookies = ctx.request.headers.get("cookie");
+	if (!cookies) return null;
+	const match = cookies.match(new RegExp(`(?:^|;\\s*)${SEGMENT_COOKIE_NAME}=([^;]+)`));
+	if (!match?.[1]) return null;
+	return `${SEGMENT_COOKIE_NAME}=${match[1]}`;
+}
+
+/** Case-insensitive lookup for `cookie` / `Cookie` in a headers init. */
+function hasCookieHeader(headers: HeadersInit | undefined): boolean {
+	if (!headers) return false;
+	if (headers instanceof Headers) return headers.has("cookie");
+	if (Array.isArray(headers)) {
+		return headers.some(([k]) => k.toLowerCase() === "cookie");
+	}
+	return Object.keys(headers).some((k) => k.toLowerCase() === "cookie");
+}
+
 export async function vtexFetchResponse(path: string, init?: RequestInit): Promise<Response> {
 	const raw = path.startsWith("http") ? path : `${baseUrl()}${path}`;
 	const url = sanitizeUrl(raw);
+
+	// Forward the incoming `vtex_segment` cookie on outgoing calls when
+	// the caller hasn't set a cookie header explicitly. This is what the
+	// Legacy Catalog API (and a handful of other VTEX endpoints) needs
+	// to resolve regional sellers correctly. Without it, products only
+	// available via a region's seller appear as OutOfStock on PDPs even
+	// for users with the cookie. Sites used to wrap `_fetch` themselves
+	// to do this — see https://github.com/decocms/apps-start#regional-sellers
+	const segmentCookie = !hasCookieHeader(init?.headers) ? getSegmentCookieHeader() : null;
+
 	const response = await _fetch(url, {
 		...init,
-		headers: { ...authHeaders(), ...init?.headers },
+		headers: {
+			...authHeaders(),
+			...(segmentCookie ? { cookie: segmentCookie } : {}),
+			...init?.headers,
+		},
 	});
 	if (!response.ok) {
 		throw new Error(`VTEX API error: ${response.status} ${response.statusText} - ${url}`);