@kotao/storefront 0.2.5 → 0.2.7

package/dist/{chunk-GGOZELAA.js → chunk-DTKLAOKR.js}

@@ -1,7 +1,9 @@
 import { CONSENT_BUCKETS, readConsentCookie, CART_FORM_ACTIONS } from './chunk-OGWYTYYS.js';
-import { fetchThemeSettings } from './chunk-M7BPQ54D.js';
-import { createEventsClient, normalizeStorefrontHeaders } from './chunk-MCIFKJQK.js';
-import { SHOP_HEADER, SHOP_SIGNATURE_HEADER, SHOP_ORIGIN_HEADER, autoRedirectEnabled, AUTO_REDIRECT_LANGUAGE_HEADER, AUTO_REDIRECT_COUNTRY_HEADER, signShopContext } from '@kotao/storefront-contracts';
+import { fetchThemeSettings } from './chunk-2MRB6SMP.js';
+import { encodeUtf8Base64Url, toBase64Url, fromBase64Url, decodeBase64UrlUtf8 } from './chunk-CKGI3Y7L.js';
+import { createEventsClient, normalizeStorefrontHeaders } from './chunk-R4N565GX.js';
+import { HOSTED_SURFACE_DESIGN_INPUTS, MARKET_ID_HEADER, MARKET_DEFAULT_LOCALE_HEADER, MARKET_CANONICAL_URL_HEADER, MARKET_ROOT_URLS_HEADER, MARKET_PATH_PREFIX_HEADER, MARKET_THEME_ID_HEADER, MARKET_SETTINGS_ENVIRONMENT_HEADER, MARKET_ALTERNATE_LOCALES_HEADER, SHOP_HEADER, SHOP_SIGNATURE_HEADER, SHOP_ORIGIN_HEADER, autoRedirectEnabled, AUTO_REDIRECT_COUNTRY_HEADER, rolloutVisitorCookieHeader, signShopContext } from '@kotao/storefront-contracts';
+export { MARKET_ALTERNATE_LOCALES_HEADER, MARKET_CANONICAL_URL_HEADER, MARKET_DEFAULT_LOCALE_HEADER, MARKET_ID_HEADER, MARKET_PATH_PREFIX_HEADER, MARKET_ROOT_URLS_HEADER, MARKET_SETTINGS_ENVIRONMENT_HEADER, MARKET_THEME_ID_HEADER } from '@kotao/storefront-contracts';
 
 // src/cache/cache.ts
 var DEFAULT_STALE_IF_ERROR_SECONDS = 300;
@@ -108,12 +110,100 @@ function readCartIdCookie(cookieHeader) {
   if (cookieHeader == null || cookieHeader === "") return null;
   const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${CART_ID_COOKIE}=`));
   if (match === void 0) return null;
-  const value = decodeURIComponent(match.slice(CART_ID_COOKIE.length + 1));
-  return value === "" ? null : value;
+  try {
+    const value = decodeURIComponent(match.slice(CART_ID_COOKIE.length + 1));
+    return value === "" ? null : value;
+  } catch {
+    return null;
+  }
 }
 function buildCartIdCookie(cartId) {
   return `${CART_ID_COOKIE}=${encodeURIComponent(cartId)}; Path=/; Max-Age=${CART_MAX_AGE}; SameSite=Lax; Secure; HttpOnly`;
 }
+function clearCartIdCookie() {
+  return `${CART_ID_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax; Secure; HttpOnly`;
+}
+
+// src/customer-account/session.ts
+var CUSTOMER_SESSION_COOKIE = "kotao_customer_session";
+var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 30;
+var HOSTED_CUSTOMER_SESSION_COOKIE = "__Host-kotao_customer_session";
+var HOSTED_CUSTOMER_CSRF_COOKIE = "__Host-kotao_customer_csrf";
+var HOSTED_CUSTOMER_CSRF_HEADER = "x-kotao-csrf-token";
+var MAX_HOSTED_SESSION_MAX_AGE = 60 * 60 * 24 * 365;
+var DEFAULT_HOSTED_SESSION_MAX_AGE = MAX_HOSTED_SESSION_MAX_AGE;
+var MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH = 4096;
+var assertHostname = (hostname) => {
+  if (hostname === "" || hostname.startsWith(".") || hostname.endsWith(".")) {
+    throw new Error(`invalid shop hostname for the customer session cookie: '${hostname}'`);
+  }
+};
+function shopHostname(request) {
+  return new URL(request.url).hostname;
+}
+function buildCustomerSessionCookie(token, attrs) {
+  assertHostname(attrs.hostname);
+  const maxAge = attrs.maxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE;
+  return `${CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}; Domain=${attrs.hostname}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
+}
+function clearCustomerSessionCookie(attrs) {
+  assertHostname(attrs.hostname);
+  return `${CUSTOMER_SESSION_COOKIE}=; Domain=${attrs.hostname}; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+}
+function readCustomerSessionToken(cookieHeader) {
+  if (cookieHeader === null || cookieHeader === void 0 || cookieHeader === "") return null;
+  const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${CUSTOMER_SESSION_COOKIE}=`));
+  if (match === void 0) return null;
+  const raw = match.slice(CUSTOMER_SESSION_COOKIE.length + 1);
+  if (raw === "") return null;
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return null;
+  }
+}
+function buildHostedCustomerSessionCookie(token, attrs = {}) {
+  if (token === "") throw new Error("hosted customer session token must not be empty");
+  const maxAge = attrs.maxAgeSeconds ?? DEFAULT_HOSTED_SESSION_MAX_AGE;
+  if (!Number.isInteger(maxAge) || maxAge <= 0 || maxAge > MAX_HOSTED_SESSION_MAX_AGE) {
+    throw new Error("hosted customer session Max-Age must be between 1 second and 365 days");
+  }
+  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
+}
+function clearHostedCustomerSessionCookie() {
+  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+}
+function readHostedCustomerSessionToken(cookieHeader) {
+  return readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_SESSION_COOKIE);
+}
+function readHostedCustomerCsrfToken(cookieHeader) {
+  const token = readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_CSRF_COOKIE, 43);
+  return token !== null && /^[A-Za-z0-9_-]{43}$/.test(token) ? token : null;
+}
+function readLegacyCustomerSessionToken(cookieHeader, options) {
+  if (!options.allowLegacy) return null;
+  return readBoundedCookie(
+    cookieHeader,
+    CUSTOMER_SESSION_COOKIE,
+    MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH
+  );
+}
+function clearLegacyCustomerSessionCookie(attrs) {
+  return clearCustomerSessionCookie(attrs);
+}
+function readBoundedCookie(cookieHeader, name, maxLength = MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH) {
+  if (cookieHeader === null || cookieHeader === void 0 || cookieHeader === "") return null;
+  const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
+  if (match === void 0) return null;
+  const raw = match.slice(name.length + 1);
+  if (raw === "" || raw.length > maxLength) return null;
+  try {
+    const decoded = decodeURIComponent(raw);
+    return decoded.length <= maxLength ? decoded : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/checkout/consent.ts
 var PARAM_PREFIX = "consent_";
@@ -214,51 +304,18 @@ function assertNoZoneIdentityLeak(url) {
     }
   }
 }
-
-// src/checkout/design-tokens.ts
-var CHECKOUT_DESIGN_TOKEN_INPUTS = [
-  {
-    type: "url",
-    name: "checkoutLogoUrl",
-    label: "Checkout logo URL"
-  },
-  {
-    type: "text",
-    name: "checkoutLogoAlt",
-    label: "Checkout logo alt text",
-    defaultValue: ""
-  },
-  {
-    type: "color",
-    name: "checkoutColorAccent",
-    label: "Checkout accent color",
-    defaultValue: "#005bd3"
-  },
-  {
-    type: "color",
-    name: "checkoutColorBackground",
-    label: "Checkout background color",
-    defaultValue: "#ffffff"
-  },
-  {
-    type: "color",
-    name: "checkoutColorForeground",
-    label: "Checkout foreground color",
-    defaultValue: "#111827"
-  },
-  {
-    type: "font",
-    name: "checkoutFontBody",
-    label: "Checkout body font",
-    defaultValue: "Inter"
-  },
-  {
-    type: "font",
-    name: "checkoutFontHeading",
-    label: "Checkout heading font",
-    defaultValue: "Inter"
-  }
-];
+var CHECKOUT_TOKEN_DEFAULTS = {
+  checkoutLogoAlt: "",
+  checkoutColorAccent: "#005bd3",
+  checkoutColorBackground: "#ffffff",
+  checkoutColorForeground: "#111827",
+  checkoutFontBody: "Inter",
+  checkoutFontHeading: "Inter"
+};
+var CHECKOUT_DESIGN_TOKEN_INPUTS = HOSTED_SURFACE_DESIGN_INPUTS.map((input) => ({
+  ...input,
+  ...input.name in CHECKOUT_TOKEN_DEFAULTS ? { defaultValue: CHECKOUT_TOKEN_DEFAULTS[input.name] } : {}
+}));
 function extractCheckoutDesignTokens(snapshot) {
   const global = snapshot.global;
   const logoUrl = optionalString(global["checkoutLogoUrl"], "checkoutLogoUrl");
@@ -316,6 +373,7 @@ var CART_FRAGMENT = (
       email
       phone
       countryCode
+      companyLocationId
     }
     note
     attributes {
@@ -575,6 +633,8 @@ function createCartHandler(opts) {
     cartId = void 0;
   }
   const consent = readConsentCookie(request?.headers.get("cookie"));
+  const cookieHeader = request?.headers.get("cookie");
+  const customerAccessToken = readHostedCustomerSessionToken(cookieHeader) ?? readCustomerSessionToken(cookieHeader);
   const currentCartId = async () => {
     if (cartId !== void 0) return cartId;
     cartId = await getCartId() ?? null;
@@ -611,9 +671,16 @@ function createCartHandler(opts) {
     return headers;
   };
   const create = async (input = {}) => {
+    const effectiveInput = customerAccessToken === null ? input : {
+      ...input,
+      buyerIdentity: {
+        ...input.buyerIdentity,
+        customerAccessToken: input.buyerIdentity?.customerAccessToken ?? customerAccessToken
+      }
+    };
     const data = await opts.storefront.mutate(
       CART_CREATE_MUTATION,
-      { variables: { input } }
+      { variables: { input: effectiveInput } }
     );
     return withCookie(data.cartCreate);
   };
@@ -732,87 +799,6 @@ function appendSetCartIdHeaders(headers, value) {
   }
 }
 
-// src/customer-account/session.ts
-var CUSTOMER_SESSION_COOKIE = "kotao_customer_session";
-var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 30;
-var HOSTED_CUSTOMER_SESSION_COOKIE = "__Host-kotao_customer_session";
-var HOSTED_CUSTOMER_CSRF_COOKIE = "__Host-kotao_customer_csrf";
-var HOSTED_CUSTOMER_CSRF_HEADER = "x-kotao-csrf-token";
-var MAX_HOSTED_SESSION_MAX_AGE = 60 * 60 * 24 * 365;
-var DEFAULT_HOSTED_SESSION_MAX_AGE = MAX_HOSTED_SESSION_MAX_AGE;
-var MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH = 4096;
-var assertHostname = (hostname) => {
-  if (hostname === "" || hostname.startsWith(".") || hostname.endsWith(".")) {
-    throw new Error(`invalid shop hostname for the customer session cookie: '${hostname}'`);
-  }
-};
-function shopHostname(request) {
-  return new URL(request.url).hostname;
-}
-function buildCustomerSessionCookie(token, attrs) {
-  assertHostname(attrs.hostname);
-  const maxAge = attrs.maxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE;
-  return `${CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}; Domain=${attrs.hostname}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
-}
-function clearCustomerSessionCookie(attrs) {
-  assertHostname(attrs.hostname);
-  return `${CUSTOMER_SESSION_COOKIE}=; Domain=${attrs.hostname}; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
-}
-function readCustomerSessionToken(cookieHeader) {
-  if (cookieHeader === null || cookieHeader === void 0 || cookieHeader === "") return null;
-  const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${CUSTOMER_SESSION_COOKIE}=`));
-  if (match === void 0) return null;
-  const raw = match.slice(CUSTOMER_SESSION_COOKIE.length + 1);
-  if (raw === "") return null;
-  try {
-    return decodeURIComponent(raw);
-  } catch {
-    return null;
-  }
-}
-function buildHostedCustomerSessionCookie(token, attrs = {}) {
-  if (token === "") throw new Error("hosted customer session token must not be empty");
-  const maxAge = attrs.maxAgeSeconds ?? DEFAULT_HOSTED_SESSION_MAX_AGE;
-  if (!Number.isInteger(maxAge) || maxAge <= 0 || maxAge > MAX_HOSTED_SESSION_MAX_AGE) {
-    throw new Error("hosted customer session Max-Age must be between 1 second and 365 days");
-  }
-  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
-}
-function clearHostedCustomerSessionCookie() {
-  return `${HOSTED_CUSTOMER_SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
-}
-function readHostedCustomerSessionToken(cookieHeader) {
-  return readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_SESSION_COOKIE);
-}
-function readHostedCustomerCsrfToken(cookieHeader) {
-  const token = readBoundedCookie(cookieHeader, HOSTED_CUSTOMER_CSRF_COOKIE, 43);
-  return token !== null && /^[A-Za-z0-9_-]{43}$/.test(token) ? token : null;
-}
-function readLegacyCustomerSessionToken(cookieHeader, options) {
-  if (!options.allowLegacy) return null;
-  return readBoundedCookie(
-    cookieHeader,
-    CUSTOMER_SESSION_COOKIE,
-    MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH
-  );
-}
-function clearLegacyCustomerSessionCookie(attrs) {
-  return clearCustomerSessionCookie(attrs);
-}
-function readBoundedCookie(cookieHeader, name, maxLength = MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH) {
-  if (cookieHeader === null || cookieHeader === void 0 || cookieHeader === "") return null;
-  const match = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
-  if (match === void 0) return null;
-  const raw = match.slice(name.length + 1);
-  if (raw === "" || raw.length > maxLength) return null;
-  try {
-    const decoded = decodeURIComponent(raw);
-    return decoded.length <= maxLength ? decoded : null;
-  } catch {
-    return null;
-  }
-}
-
 // src/customer-account/types.ts
 var CustomerAccountError = class extends Error {
   code;
@@ -1216,6 +1202,9 @@ function createCustomerAccountClient(opts) {
       }
     },
     async account() {
+      if (token === null) {
+        throw new CustomerAccountError("unauthenticated", "account read: not logged in");
+      }
       return readJson(await proxyGet("/account"), "account read");
     },
     async orders(options) {
@@ -1294,22 +1283,6 @@ function idTokenNonce(idToken) {
   }
 }
 
-// src/geo/base64url.ts
-var toBase64Url = (bytes) => {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-var fromBase64Url = (s) => {
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-};
-var encodeUtf8Base64Url = (text) => toBase64Url(new TextEncoder().encode(text));
-var decodeBase64UrlUtf8 = (s) => new TextDecoder().decode(fromBase64Url(s));
-
 // src/geo/geo.ts
 var GEO_HEADER = "x-kotao-geo";
 var GEO_SIGNATURE_HEADER = "x-kotao-geo-signature";
@@ -1384,7 +1357,10 @@ function splitFirstPathSegment(pathname) {
   const withoutSlash = pathname.slice(1);
   const slash = withoutSlash.indexOf("/");
   if (slash === -1) return { segment: withoutSlash, rest: "" };
-  return { segment: withoutSlash.slice(0, slash), rest: withoutSlash.slice(slash) };
+  return {
+    segment: withoutSlash.slice(0, slash),
+    rest: withoutSlash.slice(slash)
+  };
 }
 function isLocalePathSegment(segment) {
   return LOCALE_SEGMENT_RE.test(segment);
@@ -1475,12 +1451,16 @@ function localizePath(path, locale, options = {}) {
   const targetLocale = normalizeLocale(locale);
   const primaryLocale = normalizeLocale(options.primaryLocale);
   const url = new URL(path.startsWith("/") ? path : "/", "https://storefront.local");
-  const stripped = stripLocalePrefixFromPathname(url.pathname).pathname;
+  const marketPrefix = options.marketPathPrefix !== null && options.marketPathPrefix !== void 0 && options.marketPathPrefix.startsWith("/") ? options.marketPathPrefix.replace(/\/+$/u, "") : null;
+  const withoutMarket = marketPrefix !== null && (url.pathname === marketPrefix || url.pathname.startsWith(`${marketPrefix}/`)) ? url.pathname.slice(marketPrefix.length) || "/" : url.pathname;
+  const stripped = stripLocalePrefixFromPathname(withoutMarket).pathname;
   const suffix = `${url.search}${url.hash}`;
+  const marketBase = marketPrefix ?? "";
   if (targetLocale === null || primaryLocale !== null && targetLocale === primaryLocale) {
-    return `${stripped}${suffix}`;
+    return `${marketBase}${stripped}${suffix}` || "/";
   }
-  return `${stripped === "/" ? `/${targetLocale}` : `/${targetLocale}${stripped}`}${suffix}`;
+  const localized = stripped === "/" ? `/${targetLocale}` : `/${targetLocale}${stripped}`;
+  return `${marketBase}${localized}${suffix}`;
 }
 
 // src/storefront-client/client.ts
@@ -1802,6 +1782,40 @@ async function localSignedShopContextHeaders(key, siteId, hostname) {
   );
   return { [SHOP_HEADER]: payload, [SHOP_SIGNATURE_HEADER]: signature };
 }
+function marketContextFromHeaders(headers) {
+  const id = headers.get(MARKET_ID_HEADER)?.trim();
+  const defaultLocale = headers.get(MARKET_DEFAULT_LOCALE_HEADER)?.trim();
+  const canonicalUrl = headers.get(MARKET_CANONICAL_URL_HEADER)?.trim();
+  const encodedRoots = headers.get(MARKET_ROOT_URLS_HEADER);
+  if (!id || !defaultLocale || !canonicalUrl?.startsWith("https://") || encodedRoots === null || encodedRoots.length > 32768) {
+    return null;
+  }
+  let rootUrls;
+  try {
+    const parsed = JSON.parse(encodedRoots);
+    if (!Array.isArray(parsed) || parsed.length === 0 || !parsed.every(
+      (root) => typeof root === "object" && root !== null && "locale" in root && typeof root.locale === "string" && "url" in root && typeof root.url === "string" && root.url.startsWith("https://")
+    )) {
+      return null;
+    }
+    rootUrls = parsed;
+  } catch {
+    return null;
+  }
+  const pathPrefix = headers.get(MARKET_PATH_PREFIX_HEADER)?.trim();
+  const themeId = headers.get(MARKET_THEME_ID_HEADER)?.trim();
+  const settingsEnvironmentHandle = headers.get(MARKET_SETTINGS_ENVIRONMENT_HEADER)?.trim();
+  return {
+    id,
+    pathPrefix: pathPrefix ? pathPrefix : null,
+    defaultLocale,
+    alternateLocales: headers.get(MARKET_ALTERNATE_LOCALES_HEADER)?.split(",").map((locale) => locale.trim()).filter((locale) => locale.length > 0) ?? [],
+    rootUrls,
+    canonicalUrl,
+    themeId: themeId ? themeId : null,
+    settingsEnvironmentHandle: settingsEnvironmentHandle ? settingsEnvironmentHandle : null
+  };
+}
 var CACHE_NAME = "kotao-storefront-v1";
 var CACHE_VERSION_HEADER = "x-kotao-cache-version";
 var REQUEST_ID_HEADER = "x-kotao-request-id";
@@ -1842,6 +1856,36 @@ function resolveStorefrontApiEndpoint(endpoint, requestUrl) {
     return new URL("/api/storefront", requestUrl).toString();
   return endpoint;
 }
+var STOREFRONT_API_PROTECTED_HEADERS = [
+  SHOP_HEADER,
+  SHOP_ORIGIN_HEADER,
+  SHOP_SIGNATURE_HEADER,
+  "x-kotao-locale",
+  "x-kotao-country",
+  REQUEST_ID_HEADER,
+  DEPLOYMENT_ID_HEADER
+];
+function createStorefrontApiFetch(endpoint, defaultHeaders) {
+  const base = new URL(endpoint);
+  const basePath = base.pathname.replace(/\/+$/, "") || "/";
+  return async (input, init) => {
+    const inputUrl = input instanceof Request ? input.url : String(input);
+    const target = new URL(inputUrl, base);
+    const withinBasePath = basePath === "/" || target.pathname === basePath || target.pathname.startsWith(`${basePath}/`);
+    if (target.username !== "" || target.password !== "" || target.origin !== base.origin || !withinBasePath) {
+      throw new TypeError("storefront API fetch target is outside the configured endpoint");
+    }
+    const request = new Request(input instanceof Request ? input : target, {
+      ...init,
+      // Never forward signed shop headers across a redirect selected by untrusted theme code.
+      redirect: "manual"
+    });
+    const headers = new Headers(request.headers);
+    for (const name of STOREFRONT_API_PROTECTED_HEADERS) headers.delete(name);
+    defaultHeaders.forEach((value, name) => headers.set(name, value));
+    return fetch(new Request(request, { headers }));
+  };
+}
 async function createKotaoContext(request, env, executionCtx, deps) {
   const waitUntil = (p) => {
     executionCtx.waitUntil(p);
@@ -1863,23 +1907,31 @@ async function createKotaoContext(request, env, executionCtx, deps) {
   const siteId = resolvedEnv.KOTAO_SITE_ID ?? resolvedEnv.KOTAO_SHOP_ID;
   const inboundShop = request.headers.get(SHOP_HEADER);
   const inboundShopSignature = request.headers.get(SHOP_SIGNATURE_HEADER);
-  const signedShopContextHeaders = inboundShop !== null && inboundShopSignature !== null ? { [SHOP_HEADER]: inboundShop, [SHOP_SIGNATURE_HEADER]: inboundShopSignature } : await localSignedShopContextHeaders(
+  const signedShopContextHeaders = inboundShop !== null && inboundShopSignature !== null ? {
+    [SHOP_HEADER]: inboundShop,
+    [SHOP_SIGNATURE_HEADER]: inboundShopSignature
+  } : await localSignedShopContextHeaders(
     resolvedEnv.STOREFRONT_SHOP_CONTEXT_KEY,
     siteId,
     new URL(request.url).hostname
   );
-  const pathLocale = parseLocale(request);
+  const requestUrl = new URL(request.url);
+  const editorMode = requestUrl.searchParams.get("kotao_editor") === "1";
+  const requestedEditorLocale = editorMode ? requestUrl.searchParams.get("kotao_locale")?.trim() : void 0;
+  const requestedEditorCountry = editorMode ? requestUrl.searchParams.get("kotao_country")?.trim().toUpperCase() : void 0;
+  const editorLocale = requestedEditorLocale !== void 0 && API_LOCALE_RE.test(requestedEditorLocale) ? requestedEditorLocale : null;
+  const editorCountry = requestedEditorCountry !== void 0 && API_COUNTRY_RE.test(requestedEditorCountry) ? requestedEditorCountry : null;
+  const pathLocale = editorLocale ?? parseLocale(request);
+  const market = marketContextFromHeaders(request.headers);
   const localizationCookie = readLocalizationCookie(request.headers.get("cookie"));
-  const cookieLocale = localizationCookie.locale;
-  const autoLanguage = autoRedirectEnabled(request.headers, AUTO_REDIRECT_LANGUAGE_HEADER);
   const autoCountry = autoRedirectEnabled(request.headers, AUTO_REDIRECT_COUNTRY_HEADER);
-  const browserLocale = autoLanguage ? localeFromAcceptLanguage(request.headers.get("accept-language")) : null;
-  const selectedLocale = pathLocale ?? cookieLocale ?? browserLocale?.split("-")[0] ?? null;
-  const apiLocale = selectedLocale !== null && API_LOCALE_RE.test(selectedLocale) ? selectedLocale : void 0;
+  const apiLocale = pathLocale !== null && API_LOCALE_RE.test(pathLocale) ? pathLocale : void 0;
   const cookieCountry = localizationCookie.country !== null && API_COUNTRY_RE.test(localizationCookie.country) ? localizationCookie.country : null;
   const geoCountry = autoCountry ? geo?.country?.trim().toUpperCase() ?? null : null;
-  const apiCountry = cookieCountry ?? (geoCountry !== null && API_COUNTRY_RE.test(geoCountry) ? geoCountry : null);
+  const apiCountry = editorCountry ?? cookieCountry ?? (geoCountry !== null && API_COUNTRY_RE.test(geoCountry) ? geoCountry : null);
   const extraHeaders = {};
+  const rolloutVisitorCookie = rolloutVisitorCookieHeader(request.headers.get("cookie"));
+  if (rolloutVisitorCookie !== null) extraHeaders["cookie"] = rolloutVisitorCookie;
   const requestId = request.headers.get(REQUEST_ID_HEADER)?.trim();
   if (requestId !== void 0 && requestId.length > 0) extraHeaders[REQUEST_ID_HEADER] = requestId;
   const deploymentId = request.headers.get(DEPLOYMENT_ID_HEADER)?.trim();
@@ -1898,6 +1950,7 @@ async function createKotaoContext(request, env, executionCtx, deps) {
     cache
   });
   const eventHeaders = new Headers(signedShopContextHeaders);
+  if (rolloutVisitorCookie !== null) eventHeaders.set("cookie", rolloutVisitorCookie);
   if (apiLocale !== void 0) eventHeaders.set("x-kotao-locale", apiLocale);
   if (apiCountry !== null) eventHeaders.set("x-kotao-country", apiCountry);
   for (const [name, value] of Object.entries(extraHeaders)) eventHeaders.set(name, value);
@@ -1906,6 +1959,10 @@ async function createKotaoContext(request, env, executionCtx, deps) {
     fetch,
     defaultHeaders: eventHeaders
   });
+  const storefrontApiFetch = createStorefrontApiFetch(
+    resolvedEnv.STOREFRONT_API_ENDPOINT,
+    eventHeaders
+  );
   const cart = createCartHandler({ request, storefront });
   const contextSession = withSessionPresenceHint(
     deps?.session,
@@ -1921,12 +1978,14 @@ async function createKotaoContext(request, env, executionCtx, deps) {
   const settingsEndpoint = `${resolvedEnv.STOREFRONT_API_ENDPOINT.replace(/\/+$/, "")}/settings`;
   return {
     storefront,
+    fetch: storefrontApiFetch,
     events,
     cart,
     customerAccount,
     geo,
     withCache: createWithCache(cache),
     locale: pathLocale,
+    market,
     // Cookie-presence hint only — the theme cannot validate the HMAC; the authoritative check is the proxy.
     session: contextSession,
     env: resolvedEnv,
@@ -1934,8 +1993,15 @@ async function createKotaoContext(request, env, executionCtx, deps) {
     loadThemeSettings: (opts) => fetchThemeSettings({
       endpoint: settingsEndpoint,
       allowCrossOrigin: true,
-      ...signedShopContextHeaders ? { shopContextHeaders: signedShopContextHeaders } : {},
-      ...opts?.fetch ? { fetch: opts.fetch } : {}
+      ...signedShopContextHeaders || rolloutVisitorCookie !== null || apiCountry !== null ? {
+        shopContextHeaders: {
+          ...signedShopContextHeaders ?? {},
+          ...rolloutVisitorCookie === null ? {} : { cookie: rolloutVisitorCookie },
+          ...apiCountry === null ? {} : { "x-kotao-country": apiCountry }
+        }
+      } : {},
+      ...opts?.fetch ? { fetch: opts.fetch } : {},
+      ...opts?.templateHandle ? { templateHandle: opts.templateHandle } : {}
     })
   };
 }
@@ -1988,6 +2054,6 @@ function createEphemeralSession(isLoggedIn) {
   };
 }
 
-export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, CacheCustom, CacheLong, CacheNone, CacheShort, CustomerAccountError, DEFAULT_HOSTED_SESSION_MAX_AGE, DEFAULT_SESSION_MAX_AGE, GEO_HEADER, GEO_SIGNATURE_HEADER, HOSTED_CUSTOMER_CSRF_COOKIE, HOSTED_CUSTOMER_CSRF_HEADER, HOSTED_CUSTOMER_SESSION_COOKIE, LOCALIZATION_COOKIE, MAX_HOSTED_SESSION_MAX_AGE, MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH, ROUTING_LOCALE_HEADER, ROUTING_ORIGINAL_PATHNAME_HEADER, StorefrontDefaultCache, StorefrontQueryTimeoutError, StorefrontUpstreamError, buildCartIdCookie, buildCustomerSessionCookie, buildHostedCustomerSessionCookie, buildLocalizationCookie, cartGetIdDefault, cartSetIdDefault, clearCustomerSessionCookie, clearHostedCustomerSessionCookie, clearLegacyCustomerSessionCookie, createCache, createCartHandler, createCustomerAccountClient, createKotaoContext, createStorefrontClient, createWithCache, decodeCheckoutConsent, encodeCheckoutConsent, extractCheckoutDesignTokens, generateCacheControlHeader, isLocalePathSegment, localeFromAcceptLanguage, localeFromPathname, localeFromRequest, localizePath, originalPathnameFromRequest, readCartIdCookie, readCustomerSessionToken, readHostedCustomerCsrfToken, readHostedCustomerSessionToken, readLegacyCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, signGeo, stripLocalePrefixFromPathname, stripLocalePrefixFromRequest, trustedShopOriginFromHeaders, verifyGeo };
-//# sourceMappingURL=chunk-GGOZELAA.js.map
-//# sourceMappingURL=chunk-GGOZELAA.js.map
+export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, CacheCustom, CacheLong, CacheNone, CacheShort, CustomerAccountError, DEFAULT_HOSTED_SESSION_MAX_AGE, DEFAULT_SESSION_MAX_AGE, GEO_HEADER, GEO_SIGNATURE_HEADER, HOSTED_CUSTOMER_CSRF_COOKIE, HOSTED_CUSTOMER_CSRF_HEADER, HOSTED_CUSTOMER_SESSION_COOKIE, LOCALIZATION_COOKIE, MAX_HOSTED_SESSION_MAX_AGE, MAX_LEGACY_CUSTOMER_SESSION_TOKEN_LENGTH, ROUTING_LOCALE_HEADER, ROUTING_ORIGINAL_PATHNAME_HEADER, StorefrontDefaultCache, StorefrontQueryTimeoutError, StorefrontUpstreamError, buildCartIdCookie, buildCustomerSessionCookie, buildHostedCustomerSessionCookie, buildLocalizationCookie, cartGetIdDefault, cartSetIdDefault, clearCartIdCookie, clearCustomerSessionCookie, clearHostedCustomerSessionCookie, clearLegacyCustomerSessionCookie, createCache, createCartHandler, createCustomerAccountClient, createKotaoContext, createStorefrontClient, createWithCache, decodeCheckoutConsent, encodeCheckoutConsent, extractCheckoutDesignTokens, generateCacheControlHeader, isLocalePathSegment, localeFromAcceptLanguage, localeFromPathname, localeFromRequest, localizePath, marketContextFromHeaders, originalPathnameFromRequest, readCartIdCookie, readCustomerSessionToken, readHostedCustomerCsrfToken, readHostedCustomerSessionToken, readLegacyCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, signGeo, stripLocalePrefixFromPathname, stripLocalePrefixFromRequest, trustedShopOriginFromHeaders, verifyGeo };
+//# sourceMappingURL=chunk-DTKLAOKR.js.map
+//# sourceMappingURL=chunk-DTKLAOKR.js.map