This storefront is the controlled origin used to prove that Bonsai can preserve a customer
hostname while Cloudflare resolves the request to a Vercel deployment behind the scenes.
Storefront origin
Readiness hostname
https://vercel.storefront.zone
Underlying Vercel project URL
https://bonsai-vercel-storefront.vercel.app
The project URL is the non-vanity platform address. The readiness hostname is registered
on the same Vercel project so Vercel accepts its Host header and presents valid origin
TLS.
Customer-side DNS baseline
Authoritative zone
storefront.zone · Cloudflare DNS
Current record
vercel.storefront.zone CNAME cname.vercel-dns.com · DNS only
Rollback record
The same DNS-only Vercel CNAME
This remains the direct-origin baseline. No customer traffic points at the Bonsai
fallback while readiness is being tested.
Bonsai provider path
Cloudflare for SaaS fallback
https://ai.hibonsai.red
Worker route
ai.hibonsai.red/* → edge-worker-stg
Customer-host route
vercel.storefront.zone/* → edge-worker-stg
The shared edge worker keeps existing direct customer-zone delivery and selects the new
Vercel method only for typed custom-origin customers.
Origin resolution override
Preserved request identity
Host: vercel.storefront.zone
Provider request-override DNS
origin-vercel-storefront-zone.hibonsai.red
Vercel target
A 76.76.21.21 · Cloudflare proxied
Cloudflare changes DNS resolution with cf.resolveOverride; it does not
replace the customer Host header Vercel uses to select the project and certificate.
Reproduce the edge proof
Send the customer hostname through the staging fallback without changing public storefront
DNS.
curl -i https://ai.hibonsai.red/ \
-H 'X-Forwarded-Host: vercel.storefront.zone'
Expected evidence: HTTP 200, this page body, a Vercel request identifier, a Cloudflare
Ray, and the Bonsai WebMCP injection. An unknown forwarded hostname returns HTTP 502.