@kotao/storefront 0.2.1 → 0.2.3

package/dist/chunk-4OQYNUGM.js

@@ -0,0 +1,29 @@
+// src/events/cart.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+var SHOPIFY_CART_GID_RE = new RegExp(
+  `^gid://shopify/Cart/(${UUID_RE.source.slice(1, -1)})$`,
+  "iu"
+);
+var EventCartPreparationError = class extends Error {
+  constructor() {
+    super("Unable to prepare event cart");
+    this.name = "EventCartPreparationError";
+  }
+};
+function eventCartToken(cartId) {
+  if (UUID_RE.test(cartId)) return cartId;
+  const gidToken = SHOPIFY_CART_GID_RE.exec(cartId)?.[1];
+  if (gidToken !== void 0) return gidToken;
+  throw new EventCartPreparationError();
+}
+async function prepareEventCart(cart) {
+  const existing = await cart.get();
+  if (existing) return { cartToken: eventCartToken(existing.id), headers: new Headers() };
+  const created = await cart.create();
+  if (!created.cart || created.userErrors.length > 0) throw new EventCartPreparationError();
+  return { cartToken: eventCartToken(created.cart.id), headers: created.headers };
+}
+
+export { EventCartPreparationError, eventCartToken, prepareEventCart };
+//# sourceMappingURL=chunk-4OQYNUGM.js.map
+//# sourceMappingURL=chunk-4OQYNUGM.js.map

package/dist/chunk-4OQYNUGM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/events/cart.ts"],"names":[],"mappings":";AAEA,IAAM,OAAA,GAAU,6EAAA;AAChB,IAAM,sBAAsB,IAAI,MAAA;AAAA,EAC9B,wBAAwB,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,EAAA,CAAA;AAAA,EACnD;AACF,CAAA;AAEO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,8BAA8B,CAAA;AACpC,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AAEO,SAAS,eAAe,MAAA,EAAwB;AACrD,EAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,IAAA,CAAK,MAAM,IAAI,CAAC,CAAA;AACrD,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,EAAA,MAAM,IAAI,yBAAA,EAA0B;AACtC;AAEA,eAAsB,iBACpB,IAAA,EACkD;AAClD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,EAAI;AAChC,EAAA,IAAI,QAAA,EAAU,OAAO,EAAE,SAAA,EAAW,cAAA,CAAe,QAAA,CAAS,EAAE,CAAA,EAAG,OAAA,EAAS,IAAI,OAAA,EAAQ,EAAE;AACtF,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,MAAA,EAAO;AAClC,EAAA,IAAI,CAAC,QAAQ,IAAA,IAAQ,OAAA,CAAQ,WAAW,MAAA,GAAS,CAAA,EAAG,MAAM,IAAI,yBAAA,EAA0B;AACxF,EAAA,OAAO,EAAE,WAAW,cAAA,CAAe,OAAA,CAAQ,KAAK,EAAE,CAAA,EAAG,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ;AAChF","file":"chunk-4OQYNUGM.js","sourcesContent":["import type { CartHandler } from '../cart/createCartHandler'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu\nconst SHOPIFY_CART_GID_RE = new RegExp(\n  `^gid://shopify/Cart/(${UUID_RE.source.slice(1, -1)})$`,\n  'iu',\n)\n\nexport class EventCartPreparationError extends Error {\n  constructor() {\n    super('Unable to prepare event cart')\n    this.name = 'EventCartPreparationError'\n  }\n}\n\nexport function eventCartToken(cartId: string): string {\n  if (UUID_RE.test(cartId)) return cartId\n  const gidToken = SHOPIFY_CART_GID_RE.exec(cartId)?.[1]\n  if (gidToken !== undefined) return gidToken\n  throw new EventCartPreparationError()\n}\n\nexport async function prepareEventCart(\n  cart: CartHandler,\n): Promise<{ cartToken: string; headers: Headers }> {\n  const existing = await cart.get()\n  if (existing) return { cartToken: eventCartToken(existing.id), headers: new Headers() }\n  const created = await cart.create()\n  if (!created.cart || created.userErrors.length > 0) throw new EventCartPreparationError()\n  return { cartToken: eventCartToken(created.cart.id), headers: created.headers }\n}\n"]}

package/dist/{chunk-U5677AEA.js → chunk-4TEFGD42.js}

@@ -1,30 +1,44 @@
 import { CONSENT_BUCKETS, readConsentCookie, CART_FORM_ACTIONS } from './chunk-OGWYTYYS.js';
-import { SHOP_HEADER, SHOP_SIGNATURE_HEADER, signShopContext } from '@kotao/storefront-contracts';
+import { fetchThemeSettings } from './chunk-M7BPQ54D.js';
+import { createEventsClient, normalizeStorefrontHeaders } from './chunk-7MTCGXIG.js';
+import { SHOP_HEADER, SHOP_SIGNATURE_HEADER, SHOP_ORIGIN_HEADER, autoRedirectEnabled, AUTO_REDIRECT_LANGUAGE_HEADER, AUTO_REDIRECT_COUNTRY_HEADER, signShopContext } from '@kotao/storefront-contracts';
 
 // src/cache/cache.ts
-var CacheNone = () => ({ mode: "none", maxAge: 0, staleWhileRevalidate: 0 });
+var DEFAULT_STALE_IF_ERROR_SECONDS = 300;
+var CacheNone = () => ({
+  mode: "none",
+  maxAge: 0,
+  staleWhileRevalidate: 0,
+  staleIfError: 0
+});
 var CacheShort = (o) => ({
   mode: "short",
   maxAge: o?.maxAge ?? 1,
-  staleWhileRevalidate: o?.staleWhileRevalidate ?? 9
+  staleWhileRevalidate: o?.staleWhileRevalidate ?? 9,
+  staleIfError: o?.staleIfError ?? DEFAULT_STALE_IF_ERROR_SECONDS
 });
 var CacheLong = (o) => ({
   mode: "long",
   maxAge: o?.maxAge ?? 3600,
-  staleWhileRevalidate: o?.staleWhileRevalidate ?? 82800
+  staleWhileRevalidate: o?.staleWhileRevalidate ?? 82800,
+  staleIfError: o?.staleIfError ?? DEFAULT_STALE_IF_ERROR_SECONDS
 });
 var CacheCustom = (s) => ({
   mode: "custom",
+  staleIfError: DEFAULT_STALE_IF_ERROR_SECONDS,
   ...s
 });
 var StorefrontDefaultCache = () => ({
   mode: "custom",
   maxAge: 1,
-  staleWhileRevalidate: 86399
+  staleWhileRevalidate: 86399,
+  staleIfError: DEFAULT_STALE_IF_ERROR_SECONDS
 });
 function generateCacheControlHeader(strategy) {
   if (strategy.mode === "none") return "no-store";
-  return `public, max-age=${String(strategy.maxAge)}, stale-while-revalidate=${String(strategy.staleWhileRevalidate)}`;
+  const staleIfError = strategy.staleIfError ?? 0;
+  const staleIfErrorDirective = staleIfError > 0 ? `, stale-if-error=${String(staleIfError)}` : "";
+  return `public, max-age=${String(strategy.maxAge)}, stale-while-revalidate=${String(strategy.staleWhileRevalidate)}${staleIfErrorDirective}`;
 }
 var requestFor = (key) => new Request(`https://kotao.cache/${encodeURIComponent(key)}`);
 function createCache(opts) {
@@ -41,7 +55,7 @@ function createCache(opts) {
   };
   const write = async (key, value, strategy) => {
     const body = { value, storedAt: now() };
-    const ttl = strategy.maxAge + strategy.staleWhileRevalidate;
+    const ttl = strategy.maxAge + strategy.staleWhileRevalidate + (strategy.staleIfError ?? 0);
     await cache.put(
       requestFor(key),
       new Response(JSON.stringify(body), {
@@ -51,7 +65,7 @@ function createCache(opts) {
   };
   return {
     raw: cache,
-    async run(key, strategy, fn) {
+    async run(key, strategy, fn, onStaleIfError) {
       if (strategy.mode === "none") return fn();
       const stored = await read(key);
       if (stored) {
@@ -62,10 +76,23 @@ function createCache(opts) {
             (async () => {
               const fresh = await fn();
               await write(key, fresh, strategy);
-            })()
+            })().catch(() => void 0)
           );
           return stored.value;
         }
+        if (ageSec <= strategy.maxAge + strategy.staleWhileRevalidate + (strategy.staleIfError ?? 0)) {
+          try {
+            const value2 = await fn();
+            opts.waitUntil(write(key, value2, strategy));
+            return value2;
+          } catch (error) {
+            try {
+              onStaleIfError?.({ ageSeconds: ageSec, error });
+            } catch {
+            }
+            return stored.value;
+          }
+        }
       }
       const value = await fn();
       opts.waitUntil(write(key, value, strategy));
@@ -609,7 +636,8 @@ function createCartHandler(opts) {
       const id = await currentCartId();
       if (!id) return null;
       const data = await opts.storefront.query(CART_QUERY, {
-        variables: { cartId: id }
+        variables: { cartId: id },
+        cache: CacheNone()
       });
       return withCheckoutUrl(data.cart);
     },
@@ -707,6 +735,12 @@ function appendSetCartIdHeaders(headers, value) {
 // src/customer-account/session.ts
 var CUSTOMER_SESSION_COOKIE = "kotao_customer_session";
 var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 30;
+var HOSTED_CUSTOMER_SESSION_COOKIE = "__Host-kotao_customer_session";
+var HOSTED_CUSTOMER_CSRF_COOKIE = "__Host-kotao_customer_csrf";
+var HOSTED_CUSTOMER_CSRF_HEADER = "x-kotao-csrf-token";
+var MAX_HOSTED_SESSION_MAX_AGE = 60 * 60 * 24 * 365;
+var DEFAULT_HOSTED_SESSION_MAX_AGE = MAX_HOSTED_SESSION_MAX_AGE;
+var MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH = 4096;
 var assertHostname = (hostname) => {
   if (hostname === "" || hostname.startsWith(".") || hostname.endsWith(".")) {
     throw new Error(`invalid shop hostname for the customer session cookie: '${hostname}'`);
@@ -736,6 +770,48 @@ function readCustomerSessionToken(cookieHeader) {
     return null;
   }
 }
+function buildHostedCustomerSessionCookie(token, attrs = {}) {
+  if (token === "") throw new Error("hosted customer session token must not be empty");
+  const maxAge = attrs.maxAgeSeconds ?? DEFAULT_HOSTED_SESSION_MAX_AGE;
+  if (!Number.isInteger(maxAge) || maxAge <= 0 || maxAge > MAX_HOSTED_SESSION_MAX_AGE) {
+    throw new Error("hosted customer session Max-Age must be between 1 second and 365 days");
+  }
+  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
+}
+function clearHostedCustomerSessionCookie() {
+  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+}
+function readHostedCustomerSessionToken(cookieHeader) {
+  return readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_SESSION_COOKIE);
+}
+function readHostedCustomerCsrfToken(cookieHeader) {
+  const token = readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_CSRF_COOKIE, 43);
+  return token !== null && /^[A-Za-z0-9_-]{43}$/.test(token) ? token : null;
+}
+function readLegacyCustomerSessionToken(cookieHeader, options) {
+  if (!options.allowLegacy) return null;
+  return readBoundedCookie(
+    cookieHeader,
+    CUSTOMER_SESSION_COOKIE,
+    MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH
+  );
+}
+function clearLegacyCustomerSessionCookie(attrs) {
+  return clearCustomerSessionCookie(attrs);
+}
+function readBoundedCookie(cookieHeader, name, maxLength = MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH) {
+  if (cookieHeader === null || cookieHeader === void 0 || cookieHeader === "") return null;
+  const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
+  if (match === void 0) return null;
+  const raw = match.slice(name.length + 1);
+  if (raw === "" || raw.length > maxLength) return null;
+  try {
+    const decoded = decodeURIComponent(raw);
+    return decoded.length <= maxLength ? decoded : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/customer-account/types.ts
 var CustomerAccountError = class extends Error {
@@ -760,7 +836,11 @@ function createCustomerAccountClient(opts) {
   }
   const doFetch = opts.fetch ?? fetch;
   const cookieHeader = opts.request.headers.get("cookie");
-  const token = readCustomerSessionToken(cookieHeader);
+  const hostedToken = readHostedCustomerSessionToken(cookieHeader);
+  const legacyToken = hostedToken === null && (opts.allowLegacySessionForwarding ?? true) ? readCustomerSessionToken(cookieHeader) : null;
+  const token = hostedToken ?? legacyToken;
+  const sessionCookie = hostedToken !== null ? `${HOSTED_CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(hostedToken)}` : legacyToken !== null ? `${CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(legacyToken)}` : null;
+  const configuredShopOrigin = configuredHttpsOrigin(opts.shopOrigin);
   const hydrogenCustomerAccountId = opts.customerAccountId?.trim();
   const hydrogenShopId = opts.shopId?.trim();
   const hasHydrogenCustomerAccount = hydrogenCustomerAccountId !== void 0 && hydrogenCustomerAccountId.length > 0 && hydrogenShopId !== void 0 && hydrogenShopId.length > 0;
@@ -768,7 +848,8 @@ function createCustomerAccountClient(opts) {
   const proxyGet = async (path) => {
     try {
       return await doFetch(`${proxyBase}${path}`, {
-        headers: token !== null ? { cookie: `${CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}` } : {}
+        redirect: "manual",
+        headers: sessionCookie !== null ? { cookie: sessionCookie } : {}
       });
     } catch (cause) {
       throw new CustomerAccountError(
@@ -791,21 +872,45 @@ function createCustomerAccountClient(opts) {
     }
   };
   const proxyPost = async (path, body) => {
+    const csrf = await csrfHeaders();
+    if (csrf === null) return new Response(null, { status: 503 });
     return doFetch(`${proxyBase}${path}`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      redirect: "manual",
+      headers: { "content-type": "application/json", ...csrf.headers },
       body: JSON.stringify(body)
     });
   };
   const proxyWrite = async (path, method, body) => {
-    const headers = { "content-type": "application/json" };
-    if (token !== null) headers.cookie = `${CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}`;
+    const csrf = await csrfHeaders();
+    if (csrf === null) return new Response(null, { status: 503 });
+    const headers = { "content-type": "application/json", ...csrf.headers };
     return doFetch(`${proxyBase}${path}`, {
       method,
+      redirect: "manual",
       headers,
       ...body !== void 0 ? { body: JSON.stringify(body) } : {}
     });
   };
+  const csrfHeaders = async () => {
+    if (configuredShopOrigin === null) return null;
+    let csrfToken = readHostedCustomerCsrfToken(cookieHeader);
+    if (csrfToken === null) {
+      const bootstrap = await doFetch(`${proxyBase}/account/csrf`, {
+        redirect: "manual",
+        headers: sessionCookie !== null ? { cookie: sessionCookie } : {}
+      });
+      csrfToken = csrfTokenFromSetCookie(bootstrap.headers);
+      if (csrfToken === null) return null;
+    }
+    return {
+      headers: {
+        Origin: configuredShopOrigin,
+        [HOSTED_CUSTOMER_CSRF_HEADER]: csrfToken,
+        cookie: [sessionCookie, `${HOSTED_CUSTOMER_CSRF_COOKIE}=${csrfToken}`].filter((value) => value !== null).join("; ")
+      }
+    };
+  };
   const returnTo = () => {
     const url = new URL(opts.request.url);
     return `${url.pathname}${url.search}`;
@@ -1045,11 +1150,11 @@ function createCustomerAccountClient(opts) {
     async requestLoginCode(input) {
       try {
         const res = await proxyPost("/account/send", { email: input.email });
-        if (res.status === 200) return { status: "sent" };
-        if (res.status === 429) return { status: "rate_limited" };
-        return { status: "error" };
+        if (res.status === 200) return { status: "sent", response: res };
+        if (res.status === 429) return { status: "rate_limited", response: res };
+        return { status: "error", response: res };
       } catch {
-        return { status: "error" };
+        return { status: "error", response: new Response(null, { status: 503 }) };
       }
     },
     async verifyLoginCode(input) {
@@ -1082,18 +1187,23 @@ function createCustomerAccountClient(opts) {
           await commitHydrogenSession(headers);
         }
       } else {
-        headers.set("location", `${proxyBase}/account/logout`);
+        try {
+          return await proxyWrite("/account/logout", "POST");
+        } catch {
+          headers.set("location", "/");
+        }
       }
       headers.append(
         "set-cookie",
         clearCustomerSessionCookie({ hostname: shopHostname(opts.request) })
       );
+      headers.append("set-cookie", clearHostedCustomerSessionCookie());
       return new Response(null, { status: 302, headers });
     },
     async getAccessToken() {
       const directAccessToken = await hydrogenAccessToken();
       if (directAccessToken !== null) return directAccessToken;
-      return token;
+      return hasHydrogenCustomerAccount ? token : null;
     },
     async isLoggedIn() {
       if (await hydrogenAccessToken() !== null) return true;
@@ -1139,6 +1249,26 @@ function randomOAuthToken() {
   for (const byte of bytes) raw += String.fromCharCode(byte);
   return base64UrlEncode(raw);
 }
+function configuredHttpsOrigin(value) {
+  if (!value) return null;
+  try {
+    const candidate = value.includes("://") ? value : `https://${value}`;
+    const url = new URL(candidate);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname !== "/")
+      return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function csrfTokenFromSetCookie(headers) {
+  const values = "getSetCookie" in headers && typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [headers.get("set-cookie") ?? ""];
+  for (const value of values) {
+    const match = value.match(/(?:^|,\s*)__Host-kotao_customer_csrf=([A-Za-z0-9_-]{43})(?:;|$)/);
+    if (match?.[1]) return match[1];
+  }
+  return null;
+}
 function isHydrogenSessionLike(value) {
   return value !== null && typeof value === "object" && "get" in value && "set" in value && typeof value.get === "function" && typeof value.set === "function";
 }
@@ -1354,9 +1484,32 @@ function localizePath(path, locale, options = {}) {
 }
 
 // src/storefront-client/client.ts
+var StorefrontQueryTimeoutError = class extends Error {
+  operationName;
+  timeoutMs;
+  constructor(operationName, timeoutMs) {
+    super(`Storefront query ${operationName} timed out after ${String(timeoutMs)}ms`);
+    this.name = "StorefrontQueryTimeoutError";
+    this.operationName = operationName;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var StorefrontUpstreamError = class extends Error {
+  operationName;
+  status;
+  cause;
+  constructor(operationName, message, options) {
+    super(message);
+    this.name = "StorefrontUpstreamError";
+    this.operationName = operationName;
+    this.status = options?.status;
+    this.cause = options?.cause;
+  }
+};
 var hashKey = (query, variables) => `sf:${query.replace(/\s+/g, " ").trim()}:${variables ? JSON.stringify(variables) : ""}`;
 var COUNTRY_RE = /^[A-Z]{2}$/;
 var DEFAULT_HYDROGEN_STOREFRONT_API_VERSION = "2025-01";
+var DEFAULT_QUERY_TIMEOUT_MS = 5e3;
 function endpointForStorefrontApiVersion(endpoint, version) {
   if (version === void 0 || version.length === 0) return endpoint;
   try {
@@ -1381,6 +1534,7 @@ function createStorefrontClient(opts) {
       cache: createCache({ cache: opts.cache, waitUntil: opts.waitUntil }),
       fetch: opts.fetch,
       defaultStrategy: opts.defaultStrategy,
+      queryTimeoutMs: opts.queryTimeoutMs,
       extraHeaders: opts.storefrontHeaders,
       i18n
     });
@@ -1391,11 +1545,13 @@ function createStorefrontClient(opts) {
 function createStorefrontClientCore(opts) {
   const doFetch = opts.fetch ?? fetch;
   const defaultStrategy = opts.defaultStrategy ?? StorefrontDefaultCache();
+  const defaultQueryTimeoutMs = opts.queryTimeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS;
   const tokenHeader = opts.tokenHeader ?? "x-kotao-storefront-token";
   const localeKey = opts.locale !== void 0 && opts.locale.length > 0 ? opts.locale : "";
   const countryKey = opts.country !== void 0 && COUNTRY_RE.test(opts.country) ? opts.country : "";
   const i18n = normalizeStorefrontI18n(opts.i18n, opts.locale, countryKey);
-  const execute = async (document, options) => {
+  const execute = async (document, options, signal, timing) => {
+    const operationStartedAt = timing === void 0 ? 0 : Date.now();
     const endpoint = endpointForStorefrontApiVersion(opts.endpoint, options?.storefrontApiVersion);
     const headers = {
       "content-type": "application/json",
@@ -1412,13 +1568,67 @@ function createStorefrontClientCore(opts) {
     if (countryKey.length > 0) {
       headers["x-kotao-country"] = countryKey;
     }
-    const res = await doFetch(endpoint, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ query: document, variables: options?.variables })
-    });
-    const opName = document.replace(/\s+/g, " ").trim().slice(0, 48);
-    const raw = await res.text();
+    const operationName = operationNameFromDocument(document);
+    let res;
+    try {
+      res = await doFetch(endpoint, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ query: document, variables: options?.variables }),
+        ...signal === void 0 ? {} : { signal }
+      });
+    } catch (cause) {
+      if (signal?.aborted === true) {
+        const timeoutMs = options?.timeoutMs ?? defaultQueryTimeoutMs;
+        console.error(
+          JSON.stringify({
+            event: "storefront_query_failed",
+            failure: "timeout",
+            operationName,
+            timeoutMs
+          })
+        );
+        throw new StorefrontQueryTimeoutError(operationName, timeoutMs);
+      }
+      console.error(
+        JSON.stringify({
+          event: "storefront_query_failed",
+          failure: "transport",
+          operationName
+        })
+      );
+      throw new StorefrontUpstreamError(operationName, "Storefront API request failed", { cause });
+    }
+    const opName = operationName;
+    let raw;
+    try {
+      raw = await res.text();
+    } catch (cause) {
+      if (signal?.aborted === true) {
+        const timeoutMs = options?.timeoutMs ?? defaultQueryTimeoutMs;
+        console.error(
+          JSON.stringify({
+            event: "storefront_query_failed",
+            failure: "timeout",
+            operationName,
+            timeoutMs
+          })
+        );
+        throw new StorefrontQueryTimeoutError(operationName, timeoutMs);
+      }
+      console.error(
+        JSON.stringify({
+          event: "storefront_query_failed",
+          failure: "response_body",
+          operationName,
+          status: res.status
+        })
+      );
+      throw new StorefrontUpstreamError(operationName, "Storefront API response body failed", {
+        status: res.status,
+        cause
+      });
+    }
     let body;
     try {
       body = JSON.parse(raw);
@@ -1426,13 +1636,22 @@ function createStorefrontClientCore(opts) {
       console.error(
         `[storefront] /api/storefront non-JSON response: status=${res.status} content-type=${res.headers.get("content-type") ?? ""} len=${raw.length} op="${opName}" body=${raw.slice(0, 180)}`
       );
-      throw new Error(`Storefront API returned a non-JSON response (status ${res.status})`);
+      throw new StorefrontUpstreamError(
+        operationName,
+        `Storefront API returned a non-JSON response (status ${String(res.status)})`,
+        { status: res.status }
+      );
     }
     if (!res.ok) {
       const shopCtx = opts.signedShopContextHeaders !== void 0 ? "present" : "absent";
       console.error(
         `[storefront] /api/storefront HTTP ${res.status} endpoint=${endpoint} shopCtx=${shopCtx} op="${opName}" body=${raw.slice(0, 180)}`
       );
+      throw new StorefrontUpstreamError(
+        operationName,
+        `Storefront API returned HTTP ${String(res.status)}`,
+        { status: res.status }
+      );
     }
     if (body.errors?.length) {
       console.error(`[storefront] GraphQL query failed: ${JSON.stringify(body.errors)}`);
@@ -1444,6 +1663,19 @@ function createStorefrontClientCore(opts) {
       );
       throw new Error("Storefront API returned no data");
     }
+    if (timing !== void 0) {
+      console.info(
+        JSON.stringify({
+          event: "storefront_operation_timing",
+          operationName,
+          wallTimeMs: Math.max(0, Date.now() - operationStartedAt),
+          cacheStatus: timing.cacheStatus,
+          queryCount: 1,
+          payloadBytes: raw.length,
+          ...timing.timeoutMs !== void 0 ? { timeoutMs: timing.timeoutMs } : {}
+        })
+      );
+    }
     return body.data;
   };
   return {
@@ -1456,10 +1688,27 @@ function createStorefrontClientCore(opts) {
     query(query, options) {
       const strategy = options?.cache ?? defaultStrategy;
       const versionKey = options?.storefrontApiVersion ?? "";
+      const operationName = operationNameFromDocument(query);
       return opts.cache.run(
         `${localeKey}:${countryKey}:${versionKey}:${hashKey(query, options?.variables)}`,
         strategy,
-        () => execute(query, options)
+        () => {
+          const timeoutMs = options?.timeoutMs ?? defaultQueryTimeoutMs;
+          return execute(query, { ...options, timeoutMs }, AbortSignal.timeout(timeoutMs), {
+            cacheStatus: "miss",
+            timeoutMs
+          });
+        },
+        ({ ageSeconds, error }) => {
+          console.error(
+            JSON.stringify({
+              event: "storefront_query_cache_fallback",
+              operationName,
+              staleAgeSeconds: ageSeconds,
+              failure: storefrontFailureKind(error)
+            })
+          );
+        }
       );
     },
     mutate(mutation2, options) {
@@ -1467,6 +1716,14 @@ function createStorefrontClientCore(opts) {
     }
   };
 }
+function operationNameFromDocument(document) {
+  return /\b(?:query|mutation)\s+([_A-Za-z][_0-9A-Za-z]*)/u.exec(document)?.[1] ?? "anonymous";
+}
+function storefrontFailureKind(error) {
+  if (error instanceof StorefrontQueryTimeoutError) return "timeout";
+  if (error instanceof StorefrontUpstreamError) return "upstream";
+  return "unknown";
+}
 function isHydrogenStorefrontClientOptions(opts) {
   return "storeDomain" in opts && "publicStorefrontToken" in opts && "waitUntil" in opts;
 }
@@ -1476,7 +1733,7 @@ function attachHydrogenResult(client) {
 function headersRecord(headers) {
   if (headers === void 0) return {};
   const result = {};
-  new Headers(headers).forEach((value, key) => {
+  normalizeStorefrontHeaders(headers).forEach((value, key) => {
     result[key] = value;
   });
   return result;
@@ -1547,6 +1804,24 @@ async function localSignedShopContextHeaders(key, siteId, hostname) {
 }
 var CACHE_NAME = "kotao-storefront-v1";
 var CACHE_VERSION_HEADER = "x-kotao-cache-version";
+var REQUEST_ID_HEADER = "x-kotao-request-id";
+var DEPLOYMENT_ID_HEADER = "x-kotao-deployment-id";
+function trustedShopOrigin(value) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash) {
+      return void 0;
+    }
+    return url.origin;
+  } catch {
+    return void 0;
+  }
+}
+function trustedShopOriginFromHeaders(headers) {
+  if (!headers.has(SHOP_HEADER) || !headers.has(SHOP_SIGNATURE_HEADER)) return void 0;
+  return trustedShopOrigin(headers.get(SHOP_ORIGIN_HEADER));
+}
 var API_LOCALE_RE = /^[a-z]{2,3}(-[a-zA-Z]{2,4})?$/;
 var API_COUNTRY_RE = /^[A-Z]{2}$/;
 var SAME_ORIGIN_PATH2 = /^\/(?![/\\])/;
@@ -1596,12 +1871,21 @@ async function createKotaoContext(request, env, executionCtx, deps) {
   const pathLocale = parseLocale(request);
   const localizationCookie = readLocalizationCookie(request.headers.get("cookie"));
   const cookieLocale = localizationCookie.locale;
-  const browserLocale = localeFromAcceptLanguage(request.headers.get("accept-language"));
+  const autoLanguage = autoRedirectEnabled(request.headers, AUTO_REDIRECT_LANGUAGE_HEADER);
+  const autoCountry = autoRedirectEnabled(request.headers, AUTO_REDIRECT_COUNTRY_HEADER);
+  const browserLocale = autoLanguage ? localeFromAcceptLanguage(request.headers.get("accept-language")) : null;
   const selectedLocale = pathLocale ?? cookieLocale ?? browserLocale?.split("-")[0] ?? null;
   const apiLocale = selectedLocale !== null && API_LOCALE_RE.test(selectedLocale) ? selectedLocale : void 0;
   const cookieCountry = localizationCookie.country !== null && API_COUNTRY_RE.test(localizationCookie.country) ? localizationCookie.country : null;
-  const geoCountry = geo?.country?.trim().toUpperCase() ?? null;
+  const geoCountry = autoCountry ? geo?.country?.trim().toUpperCase() ?? null : null;
   const apiCountry = cookieCountry ?? (geoCountry !== null && API_COUNTRY_RE.test(geoCountry) ? geoCountry : null);
+  const extraHeaders = {};
+  const requestId = request.headers.get(REQUEST_ID_HEADER)?.trim();
+  if (requestId !== void 0 && requestId.length > 0) extraHeaders[REQUEST_ID_HEADER] = requestId;
+  const deploymentId = request.headers.get(DEPLOYMENT_ID_HEADER)?.trim();
+  if (deploymentId !== void 0 && deploymentId.length > 0) {
+    extraHeaders[DEPLOYMENT_ID_HEADER] = deploymentId;
+  }
   const storefront = createStorefrontClient({
     endpoint: resolvedEnv.STOREFRONT_API_ENDPOINT,
     token: resolvedEnv.STOREFRONT_API_TOKEN,
@@ -1610,21 +1894,34 @@ async function createKotaoContext(request, env, executionCtx, deps) {
     ...signedShopContextHeaders ? { signedShopContextHeaders } : {},
     ...apiLocale !== void 0 ? { locale: apiLocale } : {},
     ...apiCountry !== null ? { country: apiCountry } : {},
+    ...Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {},
     cache
   });
+  const eventHeaders = new Headers(signedShopContextHeaders);
+  if (apiLocale !== void 0) eventHeaders.set("x-kotao-locale", apiLocale);
+  if (apiCountry !== null) eventHeaders.set("x-kotao-country", apiCountry);
+  for (const [name, value] of Object.entries(extraHeaders)) eventHeaders.set(name, value);
+  const events = createEventsClient({
+    baseUrl: resolvedEnv.STOREFRONT_API_ENDPOINT,
+    fetch,
+    defaultHeaders: eventHeaders
+  });
   const cart = createCartHandler({ request, storefront });
   const contextSession = withSessionPresenceHint(
     deps?.session,
-    readCustomerSessionToken(request.headers.get("cookie")) !== null
+    readHostedCustomerSessionToken(request.headers.get("cookie")) !== null || readCustomerSessionToken(request.headers.get("cookie")) !== null
   );
   const customerAccount = createCustomerAccountClient({
     request,
     customerAccountId: resolvedEnv.PUBLIC_CUSTOMER_ACCOUNT_API_CLIENT_ID,
     shopId: resolvedEnv.SHOP_ID,
-    session: contextSession
+    session: contextSession,
+    shopOrigin: trustedShopOriginFromHeaders(request.headers) ?? (inboundShop === null && inboundShopSignature === null ? trustedShopOrigin(resolvedEnv.STOREFRONT_SHOP_ORIGIN) : void 0)
   });
+  const settingsEndpoint = `${resolvedEnv.STOREFRONT_API_ENDPOINT.replace(/\/+$/, "")}/settings`;
   return {
     storefront,
+    events,
     cart,
     customerAccount,
     geo,
@@ -1633,7 +1930,13 @@ async function createKotaoContext(request, env, executionCtx, deps) {
     // Cookie-presence hint only — the theme cannot validate the HMAC; the authoritative check is the proxy.
     session: contextSession,
     env: resolvedEnv,
-    waitUntil
+    waitUntil,
+    loadThemeSettings: (opts) => fetchThemeSettings({
+      endpoint: settingsEndpoint,
+      allowCrossOrigin: true,
+      ...signedShopContextHeaders ? { shopContextHeaders: signedShopContextHeaders } : {},
+      ...opts?.fetch ? { fetch: opts.fetch } : {}
+    })
   };
 }
 function withSessionPresenceHint(session, isLoggedIn) {
@@ -1685,6 +1988,6 @@ function createEphemeralSession(isLoggedIn) {
   };
 }
 
-export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, CacheCustom, CacheLong, CacheNone, CacheShort, CustomerAccountError, DEFAULT_SESSION_MAX_AGE, GEO_HEADER, GEO_SIGNATURE_HEADER, LOCALIZATION_COOKIE, ROUTING_LOCALE_HEADER, ROUTING_ORIGINAL_PATHNAME_HEADER, StorefrontDefaultCache, buildCartIdCookie, buildCustomerSessionCookie, buildLocalizationCookie, cartGetIdDefault, cartSetIdDefault, clearCustomerSessionCookie, createCache, createCartHandler, createCustomerAccountClient, createKotaoContext, createStorefrontClient, createWithCache, decodeCheckoutConsent, encodeCheckoutConsent, extractCheckoutDesignTokens, generateCacheControlHeader, isLocalePathSegment, localeFromAcceptLanguage, localeFromPathname, localeFromRequest, localizePath, originalPathnameFromRequest, readCartIdCookie, readCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, signGeo, stripLocalePrefixFromPathname, stripLocalePrefixFromRequest, verifyGeo };
-//# sourceMappingURL=chunk-U5677AEA.js.map
-//# sourceMappingURL=chunk-U5677AEA.js.map
+export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, CacheCustom, CacheLong, CacheNone, CacheShort, CustomerAccountError, DEFAULT_HOSTED_SESSION_MAX_AGE, DEFAULT_SESSION_MAX_AGE, GEO_HEADER, GEO_SIGNATURE_HEADER, HOSTED_CUSTOMER_CSRF_COOKIE, HOSTED_CUSTOMER_CSRF_HEADER, HOSTED_CUSTOMER_SESSION_COOKIE, LOCALIZATION_COOKIE, MAX_HOSTED_SESSION_MAX_AGE, MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH, ROUTING_LOCALE_HEADER, ROUTING_ORIGINAL_PATHNAME_HEADER, StorefrontDefaultCache, StorefrontQueryTimeoutError, StorefrontUpstreamError, buildCartIdCookie, buildCustomerSessionCookie, buildHostedCustomerSessionCookie, buildLocalizationCookie, cartGetIdDefault, cartSetIdDefault, clearCustomerSessionCookie, clearHostedCustomerSessionCookie, clearLegacyCustomerSessionCookie, createCache, createCartHandler, createCustomerAccountClient, createKotaoContext, createStorefrontClient, createWithCache, decodeCheckoutConsent, encodeCheckoutConsent, extractCheckoutDesignTokens, generateCacheControlHeader, isLocalePathSegment, localeFromAcceptLanguage, localeFromPathname, localeFromRequest, localizePath, originalPathnameFromRequest, readCartIdCookie, readCustomerSessionToken, readHostedCustomerCsrfToken, readHostedCustomerSessionToken, readLegacyCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, signGeo, stripLocalePrefixFromPathname, stripLocalePrefixFromRequest, trustedShopOriginFromHeaders, verifyGeo };
+//# sourceMappingURL=chunk-4TEFGD42.js.map
+//# sourceMappingURL=chunk-4TEFGD42.js.map