@shopify/hydrogen 2025.7.0 → 2025.7.2

package/dist/development/index.js

@@ -1,8 +1,9 @@
 import { createContext, forwardRef, useContext, lazy, useMemo, useEffect, useRef, useState, createElement, Fragment as Fragment$1, Suspense } from 'react';
-import { createContext as createContext$1, useFetcher, useFetchers, RouterContextProvider, useNavigation, useLocation, useNavigate, Link, useMatches } from 'react-router';
+import { createContext as createContext$1, useRevalidator, useFetcher, useFetchers, RouterContextProvider, createRequestHandler as createRequestHandler$1, useNavigation, useLocation, useNavigate, Link, useMatches } from 'react-router';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
-import { useLoadScript, createStorefrontClient as createStorefrontClient$1, SHOPIFY_STOREFRONT_ID_HEADER, getShopifyCookies, SHOPIFY_Y, SHOPIFY_STOREFRONT_Y_HEADER, SHOPIFY_S, SHOPIFY_STOREFRONT_S_HEADER, flattenConnection, RichText as RichText$1, ShopPayButton as ShopPayButton$1, useShopifyCookies, parseGid, sendShopifyAnalytics, AnalyticsEventName, AnalyticsPageType, getClientBrowserParameters } from '@shopify/hydrogen-react';
-export { AnalyticsEventName, AnalyticsPageType, ExternalVideo, IMAGE_FRAGMENT, Image, MediaFile, ModelViewer, Money, ShopifySalesChannel, Video, customerAccountApiCustomScalars, decodeEncodedVariant, flattenConnection, getAdjacentAndFirstAvailableVariants, getClientBrowserParameters, getProductOptions, getShopifyCookies, isOptionValueCombinationInEncodedVariant, mapSelectedProductOptionToObject, parseGid, parseMetafield, sendShopifyAnalytics, storefrontApiCustomScalars, useLoadScript, useMoney, useSelectedOptionInUrlParam, useShopifyCookies } from '@shopify/hydrogen-react';
+import { useLoadScript, useShopifyCookies, getTrackingValues, createStorefrontClient as createStorefrontClient$1, SHOPIFY_STOREFRONT_ID_HEADER, SHOPIFY_STOREFRONT_Y_HEADER, SHOPIFY_STOREFRONT_S_HEADER, SHOPIFY_UNIQUE_TOKEN_HEADER, SHOPIFY_VISIT_TOKEN_HEADER, flattenConnection, RichText as RichText$1, ShopPayButton as ShopPayButton$1, parseGid, sendShopifyAnalytics, AnalyticsEventName, AnalyticsPageType, getClientBrowserParameters } from '@shopify/hydrogen-react';
+export { AnalyticsEventName, AnalyticsPageType, ExternalVideo, IMAGE_FRAGMENT, Image, MediaFile, ModelViewer, Money, ShopifySalesChannel, Video, customerAccountApiCustomScalars, decodeEncodedVariant, flattenConnection, getAdjacentAndFirstAvailableVariants, getClientBrowserParameters, getProductOptions, getShopifyCookies, getTrackingValues, isOptionValueCombinationInEncodedVariant, mapSelectedProductOptionToObject, parseGid, parseMetafield, sendShopifyAnalytics, storefrontApiCustomScalars, useLoadScript, useMoney, useSelectedOptionInUrlParam, useShopifyCookies } from '@shopify/hydrogen-react';
+import { useLoadScript as useLoadScript$1 } from '@shopify/hydrogen-react/load-script';
 import { createGraphQLClient } from '@shopify/graphql-client';
 import { parse, stringify } from 'worktop/cookie';
 import cspBuilder from 'content-security-policy-builder';
@@ -73,7 +74,62 @@ var AnalyticsEvent = {
   // Custom
   CUSTOM_EVENT: `custom_`
 };
-var CONSENT_API = "https://cdn.shopify.com/shopifycloud/consent-tracking-api/v0.1/consent-tracking-api.js";
+
+// src/constants.ts
+var STOREFRONT_REQUEST_GROUP_ID_HEADER = "Custom-Storefront-Request-Group-ID";
+var STOREFRONT_ACCESS_TOKEN_HEADER = "X-Shopify-Storefront-Access-Token";
+var SDK_VARIANT_HEADER = "X-SDK-Variant";
+var SDK_VARIANT_SOURCE_HEADER = "X-SDK-Variant-Source";
+var SDK_VERSION_HEADER = "X-SDK-Version";
+var SHOPIFY_CLIENT_IP_HEADER = "X-Shopify-Client-IP";
+var SHOPIFY_CLIENT_IP_SIG_HEADER = "X-Shopify-Client-IP-Sig";
+var HYDROGEN_SFAPI_PROXY_KEY = "_sfapi_proxy";
+var HYDROGEN_SERVER_TRACKING_KEY = "_server_tracking";
+
+// src/utils/server-timing.ts
+function buildServerTimingHeader(values) {
+  return Object.entries(values).map(([key, value]) => value ? `${key};desc=${value}` : void 0).filter(Boolean).join(", ");
+}
+function appendServerTimingHeader(response, values) {
+  const header = typeof values === "string" ? values : buildServerTimingHeader(values);
+  if (header) {
+    response.headers.append("Server-Timing", header);
+  }
+}
+var trackedTimings = ["_y", "_s", "_cmp"];
+function extractServerTimingHeader(serverTimingHeader) {
+  const values = {};
+  if (!serverTimingHeader) return values;
+  const re = new RegExp(
+    `\\b(${trackedTimings.join("|")});desc="?([^",]+)"?`,
+    "g"
+  );
+  let match;
+  while ((match = re.exec(serverTimingHeader)) !== null) {
+    values[match[1]] = match[2];
+  }
+  return values;
+}
+function hasServerTimingInNavigationEntry(key) {
+  if (typeof window === "undefined") return false;
+  try {
+    const navigationEntry = window.performance.getEntriesByType(
+      "navigation"
+    )[0];
+    return !!navigationEntry?.serverTiming?.some((entry) => entry.name === key);
+  } catch (e) {
+    return false;
+  }
+}
+function isSfapiProxyEnabled() {
+  return hasServerTimingInNavigationEntry(HYDROGEN_SFAPI_PROXY_KEY);
+}
+function hasServerReturnedTrackingValues() {
+  return hasServerTimingInNavigationEntry(HYDROGEN_SERVER_TRACKING_KEY);
+}
+
+// src/customer-privacy/ShopifyCustomerPrivacy.tsx
+var CONSENT_API = "https://cdn.shopify.com/shopifycloud/consent-tracking-api/v0.2/consent-tracking-api.js";
 var CONSENT_API_WITH_BANNER = "https://cdn.shopify.com/shopifycloud/privacy-banner/storefront-banner.js";
 function logMissingConfig(fieldName) {
   console.error(
@@ -85,19 +141,34 @@ function useCustomerPrivacy(props) {
     withPrivacyBanner = false,
     onVisitorConsentCollected,
     onReady,
-    ...consentConfig
+    checkoutDomain,
+    storefrontAccessToken,
+    country,
+    locale,
+    sameDomainForStorefrontApi
   } = props;
-  useLoadScript(withPrivacyBanner ? CONSENT_API_WITH_BANNER : CONSENT_API, {
+  const hasSfapiProxy = useMemo(
+    () => sameDomainForStorefrontApi ?? isSfapiProxyEnabled(),
+    [sameDomainForStorefrontApi]
+  );
+  const fetchTrackingValuesFromBrowser = useMemo(
+    () => hasSfapiProxy && !hasServerReturnedTrackingValues(),
+    [hasSfapiProxy]
+  );
+  const cookiesReady = useShopifyCookies({
+    fetchTrackingValues: fetchTrackingValuesFromBrowser,
+    storefrontAccessToken,
+    ignoreDeprecatedCookies: true
+  });
+  const initialTrackingValues = useMemo(getTrackingValues, [cookiesReady]);
+  const { revalidate } = useRevalidator();
+  useLoadScript$1(withPrivacyBanner ? CONSENT_API_WITH_BANNER : CONSENT_API, {
     attributes: {
       id: "customer-privacy-api"
     }
   });
-  const { observing, setLoaded } = useApisLoaded({
-    withPrivacyBanner,
-    onLoaded: onReady
-  });
+  const { observing, setLoaded, apisLoaded } = useApisLoaded({ withPrivacyBanner });
   const config = useMemo(() => {
-    const { checkoutDomain, storefrontAccessToken } = consentConfig;
     if (!checkoutDomain) logMissingConfig("checkoutDomain");
     if (!storefrontAccessToken) logMissingConfig("storefrontAccessToken");
     if (storefrontAccessToken.startsWith("shpat_") || storefrontAccessToken.length !== 32) {
@@ -105,18 +176,54 @@ function useCustomerPrivacy(props) {
         `[h2:error:useCustomerPrivacy] It looks like you passed a private access token, make sure to use the public token`
       );
     }
+    const commonAncestorDomain = parseStoreDomain(checkoutDomain);
+    const sfapiDomain = (
+      // Check if standard route proxy is enabled in Hydrogen server
+      // to use it instead of doing a cross-origin request to checkout.
+      hasSfapiProxy && typeof window !== "undefined" ? window.location.host : checkoutDomain
+    );
     const config2 = {
-      checkoutRootDomain: checkoutDomain,
+      // This domain is used to send requests to SFAPI for setting and getting consent.
+      checkoutRootDomain: sfapiDomain,
+      // Prefix with a dot to ensure this domain is different from checkoutRootDomain.
+      // This will ensure old cookies are set for a cross-subdomain checkout setup
+      // so that we keep backward compatibility until new cookies are rolled out.
+      // Once consent-tracking-api is updated to not rely on cookies anymore, we can remove this.
+      storefrontRootDomain: commonAncestorDomain ? "." + commonAncestorDomain : void 0,
       storefrontAccessToken,
-      storefrontRootDomain: parseStoreDomain(checkoutDomain),
-      country: consentConfig.country,
-      locale: consentConfig.locale
+      country,
+      locale
     };
     return config2;
-  }, [consentConfig, parseStoreDomain, logMissingConfig]);
+  }, [
+    logMissingConfig,
+    checkoutDomain,
+    storefrontAccessToken,
+    country,
+    locale
+  ]);
   useEffect(() => {
     const consentCollectedHandler = (event) => {
+      const latestTrackingValues = getTrackingValues();
+      if (initialTrackingValues.visitToken !== latestTrackingValues.visitToken || initialTrackingValues.uniqueToken !== latestTrackingValues.uniqueToken) {
+        revalidate().catch(() => {
+          console.warn(
+            "[h2:warn:useCustomerPrivacy] Revalidation failed after consent change."
+          );
+        });
+      }
       if (onVisitorConsentCollected) {
+        const customerPrivacy = getCustomerPrivacy();
+        if (customerPrivacy?.shouldShowBanner()) {
+          const consentValues = customerPrivacy.currentVisitorConsent();
+          if (consentValues) {
+            const NO_VALUE = "";
+            const noInteraction = consentValues.marketing === NO_VALUE && consentValues.analytics === NO_VALUE && consentValues.preferences === NO_VALUE;
+            if (noInteraction) {
+              return;
+            }
+          }
+        }
         onVisitorConsentCollected(event.detail);
       }
     };
@@ -142,14 +249,11 @@ function useCustomerPrivacy(props) {
       },
       set(value) {
         if (typeof value === "object" && value !== null && "showPreferences" in value && "loadBanner" in value) {
-          const privacyBanner = value;
-          privacyBanner.loadBanner(config);
           customPrivacyBanner = overridePrivacyBannerMethods({
-            privacyBanner,
+            privacyBanner: value,
             config
           });
           setLoaded.privacyBanner();
-          emitCustomerPrivacyApiLoaded();
         }
       }
     };
@@ -183,6 +287,8 @@ function useCustomerPrivacy(props) {
                 const customerPrivacy = value2;
                 customCustomerPrivacy = {
                   ...customerPrivacy,
+                  // Note: this method is not used by the privacy-banner,
+                  // it bundles its own setTrackingConsent.
                   setTrackingConsent: overrideCustomerPrivacySetTrackingConsent(
                     { customerPrivacy, config }
                   )
@@ -192,7 +298,6 @@ function useCustomerPrivacy(props) {
                   customerPrivacy: customCustomerPrivacy
                 };
                 setLoaded.customerPrivacy();
-                emitCustomerPrivacyApiLoaded();
               }
             }
           });
@@ -204,6 +309,24 @@ function useCustomerPrivacy(props) {
     overrideCustomerPrivacySetTrackingConsent,
     setLoaded.customerPrivacy
   ]);
+  useEffect(() => {
+    if (!apisLoaded || !cookiesReady) return;
+    const customerPrivacy = getCustomerPrivacy();
+    if (customerPrivacy && !customerPrivacy.cachedConsent) {
+      const trackingValues = getTrackingValues();
+      if (trackingValues.consent) {
+        customerPrivacy.cachedConsent = trackingValues.consent;
+      }
+    }
+    if (withPrivacyBanner) {
+      const privacyBanner = getPrivacyBanner();
+      if (privacyBanner) {
+        privacyBanner.loadBanner(config);
+      }
+    }
+    emitCustomerPrivacyApiLoaded();
+    onReady?.();
+  }, [apisLoaded, cookiesReady]);
   const result = {
     customerPrivacy: getCustomerPrivacy()
   };
@@ -219,15 +342,12 @@ function emitCustomerPrivacyApiLoaded() {
   const event = new CustomEvent("shopifyCustomerPrivacyApiLoaded");
   document.dispatchEvent(event);
 }
-function useApisLoaded({
-  withPrivacyBanner,
-  onLoaded
-}) {
+function useApisLoaded({ withPrivacyBanner }) {
   const observing = useRef({ customerPrivacy: false, privacyBanner: false });
-  const [apisLoaded, setApisLoaded] = useState(
+  const [apisLoadedArray, setApisLoaded] = useState(
     withPrivacyBanner ? [false, false] : [false]
   );
-  const loaded = apisLoaded.every(Boolean);
+  const apisLoaded = apisLoadedArray.every(Boolean);
   const setLoaded = {
     customerPrivacy: () => {
       if (withPrivacyBanner) {
@@ -243,16 +363,11 @@ function useApisLoaded({
       setApisLoaded((prev) => [prev[0], true]);
     }
   };
-  useEffect(() => {
-    if (loaded && onLoaded) {
-      onLoaded();
-    }
-  }, [loaded, onLoaded]);
-  return { observing, setLoaded };
+  return { observing, setLoaded, apisLoaded };
 }
 function parseStoreDomain(checkoutDomain) {
   if (typeof window === "undefined") return;
-  const host = window.document.location.host;
+  const host = window.location.host;
   const checkoutDomainParts = checkoutDomain.split(".").reverse();
   const currentDomainParts = host.split(".").reverse();
   const sameDomainParts = [];
@@ -261,7 +376,7 @@ function parseStoreDomain(checkoutDomain) {
       sameDomainParts.push(part);
     }
   });
-  return sameDomainParts.reverse().join(".");
+  return sameDomainParts.reverse().join(".") || void 0;
 }
 function overrideCustomerPrivacySetTrackingConsent({
   customerPrivacy,
@@ -319,7 +434,7 @@ function getPrivacyBanner() {
 }
 
 // package.json
-var version = "2025.7.0";
+var version = "2025.7.2";
 
 // src/analytics-manager/ShopifyAnalytics.tsx
 function getCustomerPrivacyRequired() {
@@ -339,6 +454,7 @@ function ShopifyAnalytics({
   const { subscribe: subscribe2, register: register2, canTrack } = useAnalytics();
   const [shopifyReady, setShopifyReady] = useState(false);
   const [privacyReady, setPrivacyReady] = useState(false);
+  const [collectedConsent, setCollectedConsent] = useState("");
   const init = useRef(false);
   const { checkoutDomain, storefrontAccessToken, language } = consent;
   const { ready: shopifyAnalyticsReady } = register2("Internal_Shopify_Analytics");
@@ -347,14 +463,31 @@ function ShopifyAnalytics({
     locale: language,
     checkoutDomain: !checkoutDomain ? "mock.shop" : checkoutDomain,
     storefrontAccessToken: !storefrontAccessToken ? "abcdefghijklmnopqrstuvwxyz123456" : storefrontAccessToken,
-    onVisitorConsentCollected: () => setPrivacyReady(true),
-    onReady: () => setPrivacyReady(true)
+    // If we use privacy banner, we should wait until consent is collected.
+    // Otherwise, we can consider privacy ready immediately:
+    onReady: () => !consent.withPrivacyBanner && setPrivacyReady(true),
+    onVisitorConsentCollected: (consent2) => {
+      try {
+        setCollectedConsent(JSON.stringify(consent2));
+      } catch (e) {
+      }
+      setPrivacyReady(true);
+    }
   });
+  const hasUserConsent = useMemo(
+    // must be initialized with true to avoid removing cookies too early
+    () => privacyReady ? canTrack() : true,
+    // Make this value depend on collectedConsent to re-run `canTrack()` when consent changes
+    [privacyReady, canTrack, collectedConsent]
+  );
   useShopifyCookies({
-    hasUserConsent: privacyReady ? canTrack() : true,
-    // must be initialized with true
+    hasUserConsent,
     domain,
-    checkoutDomain
+    checkoutDomain,
+    // Already done inside useCustomerPrivacy
+    fetchTrackingValues: false,
+    // Avoid creating local cookies too early
+    ignoreDeprecatedCookies: !privacyReady
   });
   useEffect(() => {
     if (init.current) return;
@@ -404,11 +537,11 @@ function prepareBasePageViewPayload(payload) {
     ...payload.shop,
     hasUserConsent,
     ...getClientBrowserParameters(),
-    ccpaEnforced: !customerPrivacy.saleOfDataAllowed(),
-    gdprEnforced: !(customerPrivacy.marketingAllowed() && customerPrivacy.analyticsProcessingAllowed()),
     analyticsAllowed: customerPrivacy.analyticsProcessingAllowed(),
     marketingAllowed: customerPrivacy.marketingAllowed(),
-    saleOfDataAllowed: customerPrivacy.saleOfDataAllowed()
+    saleOfDataAllowed: customerPrivacy.saleOfDataAllowed(),
+    ccpaEnforced: !customerPrivacy.saleOfDataAllowed(),
+    gdprEnforced: !(customerPrivacy.marketingAllowed() && customerPrivacy.analyticsProcessingAllowed())
   };
   return eventPayload;
 }
@@ -841,11 +974,11 @@ function AnalyticsProvider({
   shop: shopProp = null,
   cookieDomain
 }) {
-  const listenerSet = useRef(false);
   const { shop } = useShopAnalytics(shopProp);
   const [analyticsLoaded, setAnalyticsLoaded] = useState(
     customCanTrack ? true : false
   );
+  const [consentCollected, setConsentCollected] = useState(false);
   const [carts, setCarts] = useState({ cart: null, prevCart: null });
   const [canTrack, setCanTrack] = useState(
     customCanTrack ? () => customCanTrack : () => shopifyCanTrack
@@ -913,21 +1046,21 @@ function AnalyticsProvider({
     children,
     !!shop && /* @__PURE__ */ jsx(AnalyticsPageView, {}),
     !!shop && !!currentCart && /* @__PURE__ */ jsx(CartAnalytics, { cart: currentCart, setCarts }),
-    !!shop && consent.checkoutDomain && /* @__PURE__ */ jsx(
+    !!shop && /* @__PURE__ */ jsx(
       ShopifyAnalytics,
       {
         consent,
         onReady: () => {
-          listenerSet.current = true;
           setAnalyticsLoaded(true);
           setCanTrack(
             customCanTrack ? () => customCanTrack : () => shopifyCanTrack
           );
+          setConsentCollected(true);
         },
         domain: cookieDomain
       }
     ),
-    !!shop && /* @__PURE__ */ jsx(PerfKit, { shop })
+    !!shop && consentCollected && /* @__PURE__ */ jsx(PerfKit, { shop })
   ] });
 }
 function useAnalytics() {
@@ -1006,6 +1139,31 @@ function getDebugHeaders(request) {
     purpose: request ? getHeader(request, "purpose") : void 0
   };
 }
+function getStorefrontHeaders(request) {
+  return {
+    requestGroupId: getHeader(request, "request-id"),
+    buyerIp: getHeader(request, "oxygen-buyer-ip"),
+    buyerIpSig: getHeader(request, SHOPIFY_CLIENT_IP_SIG_HEADER),
+    cookie: getHeader(request, "cookie"),
+    // sec-purpose is added by browsers automatically when using link/prefetch or Speculation Rules
+    purpose: getHeader(request, "sec-purpose") || getHeader(request, "purpose")
+  };
+}
+var SFAPI_RE = /^\/api\/(unstable|2\d{3}-\d{2})\/graphql\.json$/;
+var getSafePathname = (url) => {
+  try {
+    return new URL(url, "http://e.c").pathname;
+  } catch {
+    return "/";
+  }
+};
+function extractHeaders(extract, keys) {
+  return keys.reduce((acc, key) => {
+    const forwardedValue = extract(key);
+    if (forwardedValue) acc.push([key, forwardedValue]);
+    return acc;
+  }, []);
+}
 
 // src/utils/callsites.ts
 function withSyncStack(promise, options = {}) {
@@ -1373,13 +1531,16 @@ async function runWithCache(cacheKey, actionFn, {
   }
   return result;
 }
+var excludedHeaders = ["set-cookie", "server-timing"];
 function toSerializableResponse(body, response) {
   return [
     body,
     {
       status: response.status,
       statusText: response.statusText,
-      headers: Array.from(response.headers.entries())
+      headers: [...response.headers].filter(
+        ([key]) => !excludedHeaders.includes(key.toLowerCase())
+      )
     }
   ];
 }
@@ -1393,7 +1554,8 @@ async function fetchWithServerCache(url, requestInit, {
   shouldCacheResponse,
   waitUntil,
   debugInfo,
-  streamConfig
+  streamConfig,
+  onRawHeaders
 }) {
   if (!cacheOptions && (!requestInit.method || requestInit.method === "GET")) {
     cacheOptions = CacheShort();
@@ -1407,6 +1569,7 @@ async function fetchWithServerCache(url, requestInit, {
           url,
           customFetchApi: async (url2, options) => {
             rawResponse = await fetch(url2, options);
+            onRawHeaders?.(rawResponse.headers);
             return rawResponse;
           },
           headers: requestInit.headers
@@ -1430,6 +1593,7 @@ async function fetchWithServerCache(url, requestInit, {
         );
       }
       const response = await fetch(url, requestInit);
+      onRawHeaders?.(response.headers);
       if (!response.ok) {
         return response;
       }
@@ -1653,13 +1817,6 @@ var cartSetIdDefault = (cookieOptions) => {
   };
 };
 
-// src/constants.ts
-var STOREFRONT_REQUEST_GROUP_ID_HEADER = "Custom-Storefront-Request-Group-ID";
-var STOREFRONT_ACCESS_TOKEN_HEADER = "X-Shopify-Storefront-Access-Token";
-var SDK_VARIANT_HEADER = "X-SDK-Variant";
-var SDK_VARIANT_SOURCE_HEADER = "X-SDK-Variant-Source";
-var SDK_VERSION_HEADER = "X-SDK-Version";
-
 // src/utils/uuid.ts
 function generateUUID() {
   if (typeof crypto !== "undefined" && !!crypto.randomUUID) {
@@ -1670,7 +1827,7 @@ function generateUUID() {
 }
 
 // src/version.ts
-var LIB_VERSION = "2025.7.0";
+var LIB_VERSION = "2025.7.2";
 
 // src/utils/graphql.ts
 function minifyQuery(string) {
@@ -1834,16 +1991,34 @@ function createStorefrontClient(options) {
     contentType: "json",
     buyerIp: storefrontHeaders?.buyerIp || ""
   });
+  if (storefrontHeaders?.buyerIp) {
+    defaultHeaders[SHOPIFY_CLIENT_IP_HEADER] = storefrontHeaders.buyerIp;
+  }
+  if (storefrontHeaders?.buyerIpSig) {
+    defaultHeaders[SHOPIFY_CLIENT_IP_SIG_HEADER] = storefrontHeaders.buyerIpSig;
+  }
   defaultHeaders[STOREFRONT_REQUEST_GROUP_ID_HEADER] = storefrontHeaders?.requestGroupId || generateUUID();
   if (storefrontId) defaultHeaders[SHOPIFY_STOREFRONT_ID_HEADER] = storefrontId;
   defaultHeaders["user-agent"] = `Hydrogen ${LIB_VERSION}`;
-  if (storefrontHeaders && storefrontHeaders.cookie) {
-    const cookies = getShopifyCookies(storefrontHeaders.cookie ?? "");
-    if (cookies[SHOPIFY_Y])
-      defaultHeaders[SHOPIFY_STOREFRONT_Y_HEADER] = cookies[SHOPIFY_Y];
-    if (cookies[SHOPIFY_S])
-      defaultHeaders[SHOPIFY_STOREFRONT_S_HEADER] = cookies[SHOPIFY_S];
+  const requestCookie = storefrontHeaders?.cookie ?? "";
+  if (requestCookie) defaultHeaders["cookie"] = requestCookie;
+  let uniqueToken;
+  let visitToken;
+  if (!/\b_shopify_(analytics|marketing)=/.test(requestCookie)) {
+    const legacyUniqueToken = requestCookie.match(/\b_shopify_y=([^;]+)/)?.[1];
+    const legacyVisitToken = requestCookie.match(/\b_shopify_s=([^;]+)/)?.[1];
+    if (legacyUniqueToken) {
+      defaultHeaders[SHOPIFY_STOREFRONT_Y_HEADER] = legacyUniqueToken;
+    }
+    if (legacyVisitToken) {
+      defaultHeaders[SHOPIFY_STOREFRONT_S_HEADER] = legacyVisitToken;
+    }
+    uniqueToken = legacyUniqueToken ?? generateUUID();
+    visitToken = legacyVisitToken ?? generateUUID();
+    defaultHeaders[SHOPIFY_UNIQUE_TOKEN_HEADER] = uniqueToken;
+    defaultHeaders[SHOPIFY_VISIT_TOKEN_HEADER] = visitToken;
   }
+  let collectedSubrequestHeaders;
   const cacheKeyHeader = JSON.stringify({
     "content-type": defaultHeaders["content-type"],
     "user-agent": defaultHeaders["user-agent"],
@@ -1910,7 +2085,13 @@ function createStorefrontClient(options) {
         graphql: graphqlData,
         purpose: storefrontHeaders?.purpose
       },
-      streamConfig
+      streamConfig,
+      onRawHeaders: (headers2) => {
+        collectedSubrequestHeaders ??= {
+          setCookie: headers2.getSetCookie(),
+          serverTiming: headers2.get("server-timing") ?? ""
+        };
+      }
     });
     const errorOptions = {
       url,
@@ -2009,9 +2190,90 @@ function createStorefrontClient(options) {
       generateCacheControlHeader,
       getPublicTokenHeaders,
       getPrivateTokenHeaders,
+      getHeaders: () => ({ ...defaultHeaders }),
       getShopifyDomain,
       getApiUrl: getStorefrontApiUrl,
-      i18n: i18n ?? defaultI18n
+      i18n: i18n ?? defaultI18n,
+      /**
+       * Checks if the request is targeting the Storefront API endpoint.
+       */
+      isStorefrontApiUrl(request) {
+        return SFAPI_RE.test(getSafePathname(request.url ?? ""));
+      },
+      /**
+       * Forwards the request to the Storefront API.
+       */
+      async forward(request, options2) {
+        const forwardedHeaders = new Headers([
+          // Forward only a selected set of headers to the Storefront API
+          // to avoid getting 403 errors due to unexpected headers.
+          ...extractHeaders(
+            (key) => request.headers.get(key),
+            [
+              "accept",
+              "accept-encoding",
+              "accept-language",
+              // Access-Control headers are used for CORS preflight requests.
+              "access-control-request-headers",
+              "access-control-request-method",
+              "content-type",
+              "content-length",
+              "cookie",
+              "origin",
+              "referer",
+              "user-agent",
+              STOREFRONT_ACCESS_TOKEN_HEADER,
+              SHOPIFY_UNIQUE_TOKEN_HEADER,
+              SHOPIFY_VISIT_TOKEN_HEADER
+            ]
+          ),
+          // Add some headers to help with geolocalization and debugging
+          ...extractHeaders(
+            (key) => defaultHeaders[key],
+            [
+              SHOPIFY_CLIENT_IP_HEADER,
+              SHOPIFY_CLIENT_IP_SIG_HEADER,
+              SHOPIFY_STOREFRONT_ID_HEADER,
+              STOREFRONT_REQUEST_GROUP_ID_HEADER
+            ]
+          )
+        ]);
+        if (storefrontHeaders?.buyerIp) {
+          forwardedHeaders.set("x-forwarded-for", storefrontHeaders.buyerIp);
+        }
+        const storefrontApiVersion = options2?.storefrontApiVersion ?? getSafePathname(request.url).match(SFAPI_RE)?.[1];
+        const sfapiResponse = await fetch(
+          getStorefrontApiUrl({ storefrontApiVersion }),
+          {
+            method: request.method,
+            body: request.body,
+            headers: forwardedHeaders
+          }
+        );
+        return new Response(sfapiResponse.body, sfapiResponse);
+      },
+      setCollectedSubrequestHeaders: (response) => {
+        if (collectedSubrequestHeaders) {
+          for (const value of collectedSubrequestHeaders.setCookie) {
+            response.headers.append("Set-Cookie", value);
+          }
+        }
+        const serverTiming = extractServerTimingHeader(
+          collectedSubrequestHeaders?.serverTiming
+        );
+        const isDocumentResponse = response.headers.get("content-type")?.startsWith("text/html");
+        const fallbackValues = isDocumentResponse ? { _y: uniqueToken, _s: visitToken } : void 0;
+        appendServerTimingHeader(response, {
+          ...fallbackValues,
+          ...serverTiming
+        });
+        if (isDocumentResponse && collectedSubrequestHeaders && // _shopify_essential cookie is always set, but we need more than that
+        collectedSubrequestHeaders.setCookie.length > 1 && serverTiming?._y && serverTiming?._s && serverTiming?._cmp) {
+          appendServerTimingHeader(response, {
+            [HYDROGEN_SERVER_TRACKING_KEY]: "1"
+          });
+        }
+      }
     }
   };
 }
@@ -3607,6 +3869,12 @@ function createCustomerAccountClient({
       if (options?.countryCode) {
         loginUrl.searchParams.append("region_country", options.countryCode);
       }
+      if (options?.acrValues) {
+        loginUrl.searchParams.append("acr_values", options.acrValues);
+      }
+      if (options?.loginHint) {
+        loginUrl.searchParams.append("login_hint", options.loginHint);
+      }
       const verifier = generateCodeVerifier();
       const challenge = await generateCodeChallenge(verifier);
       session.set(CUSTOMER_ACCOUNT_SESSION_KEY, {
@@ -3937,12 +4205,58 @@ function createHydrogenContext(options, additionalContext) {
   });
   return hybridProvider;
 }
-function getStorefrontHeaders(request) {
-  return {
-    requestGroupId: getHeader(request, "request-id"),
-    buyerIp: getHeader(request, "oxygen-buyer-ip"),
-    cookie: getHeader(request, "cookie"),
-    purpose: getHeader(request, "purpose")
+function createRequestHandler({
+  build,
+  mode,
+  poweredByHeader = true,
+  getLoadContext,
+  collectTrackingInformation = true,
+  proxyStandardRoutes = true
+}) {
+  const handleRequest = createRequestHandler$1(build, mode);
+  const appendPoweredByHeader = poweredByHeader ? (response) => response.headers.append("powered-by", "Shopify, Hydrogen") : void 0;
+  return async (request) => {
+    const method = request.method;
+    if ((method === "GET" || method === "HEAD") && request.body) {
+      return new Response(`${method} requests cannot have a body`, {
+        status: 400
+      });
+    }
+    const url = new URL(request.url);
+    if (url.pathname.includes("//")) {
+      return new Response(null, {
+        status: 301,
+        headers: {
+          location: url.pathname.replace(/\/+/g, "/")
+        }
+      });
+    }
+    const context = await getLoadContext?.(request);
+    const storefront = context?.storefront || context?.get?.(storefrontContext);
+    if (proxyStandardRoutes) {
+      if (!storefront) {
+        warnOnce(
+          "[h2:createRequestHandler] Storefront instance is required to proxy standard routes."
+        );
+      }
+      if (storefront?.isStorefrontApiUrl(request)) {
+        const response2 = await storefront.forward(request);
+        appendPoweredByHeader?.(response2);
+        return response2;
+      }
+    }
+    const response = await handleRequest(request, context);
+    if (storefront && proxyStandardRoutes) {
+      if (collectTrackingInformation) {
+        storefront.setCollectedSubrequestHeaders(response);
+      }
+      const fetchDest = request.headers.get("sec-fetch-dest");
+      if (fetchDest && fetchDest === "document" || request.headers.get("accept")?.includes("text/html")) {
+        appendServerTimingHeader(response, { [HYDROGEN_SFAPI_PROXY_KEY]: "1" });
+      }
+    }
+    appendPoweredByHeader?.(response);
+    return response;
   };
 }
 var NonceContext = createContext(void 0);
@@ -4069,7 +4383,7 @@ function LazyScript({
 
 // src/dev/hydrogen-routes.ts
 async function hydrogenRoutes(currentRoutes) {
-  const { getVirtualRoutesV3 } = await import('./get-virtual-routes-6PVSMJPH.js');
+  const { getVirtualRoutesV3 } = await import('./get-virtual-routes-XE7G57DS.js');
   const { layout, routes: virtualRoutes } = await getVirtualRoutesV3();
   const childVirtualRoutes = virtualRoutes.map(({ path, file, index, id }) => {
     return {
@@ -4556,10 +4870,10 @@ function hydrogenPreset() {
       ssr: true,
       future: {
         v8_middleware: true,
+        v8_splitRouteModules: true,
+        v8_viteEnvironmentApi: false,
         unstable_optimizeDeps: true,
-        unstable_splitRouteModules: true,
-        unstable_subResourceIntegrity: false,
-        unstable_viteEnvironmentApi: false
+        unstable_subResourceIntegrity: false
       }
     }),
     reactRouterConfigResolved: ({ reactRouterConfig }) => {
@@ -4575,7 +4889,7 @@ function hydrogenPreset() {
       }
       if (reactRouterConfig.serverBundles) {
         throw new Error(
-          "[Hydrogen Preset] serverBundles is not supported in Hydrogen 2025.7.0.\nReason: React Router plugin manifest incompatibility with Hydrogen CLI.\nAlternative: Route-level code splitting via unstable_splitRouteModules is enabled."
+          "[Hydrogen Preset] serverBundles is not supported in Hydrogen 2025.7.0.\nReason: React Router plugin manifest incompatibility with Hydrogen CLI.\nAlternative: Route-level code splitting via v8_splitRouteModules is enabled."
         );
       }
       if (reactRouterConfig.buildEnd) {
@@ -5090,10 +5404,10 @@ var schema = {
       if (typeof value !== "string") {
         throw new Error(ERROR_PREFIX.concat("`title` should be a string"));
       }
-      if (typeof value === "string" && value.length > 120) {
+      if (typeof value === "string" && value.length > 70) {
         throw new Error(
           ERROR_PREFIX.concat(
-            "`title` should not be longer than 120 characters"
+            "`title` should not be longer than 70 characters"
           )
         );
       }
@@ -5110,7 +5424,7 @@ var schema = {
       if (typeof value === "string" && value.length > 155) {
         throw new Error(
           ERROR_PREFIX.concat(
-            "`description` should not be longer than 155 characters"
+            "`description` should not be longer than 160 characters"
           )
         );
       }
@@ -5986,6 +6300,6 @@ var QUERIES = {
 //! @see: https://shopify.dev/docs/api/storefront/latest/mutations/cartDeliveryAddressesRemove
 //! @see: https://shopify.dev/docs/api/storefront/latest/mutations/cartDeliveryAddressesUpdate
 
-export { Analytics, AnalyticsEvent, CacheCustom, CacheLong, CacheNone, CacheShort, CartForm, InMemoryCache, NonceProvider, OptimisticInput, Pagination, RichText, Script, Seo, ShopPayButton, VariantSelector, cartAttributesUpdateDefault, cartBuyerIdentityUpdateDefault, cartCreateDefault, cartDiscountCodesUpdateDefault, cartGetDefault, cartGetIdDefault, cartGiftCardCodesRemoveDefault, cartGiftCardCodesUpdateDefault, cartLinesAddDefault, cartLinesRemoveDefault, cartLinesUpdateDefault, cartMetafieldDeleteDefault, cartMetafieldsSetDefault, cartNoteUpdateDefault, cartSelectedDeliveryOptionsUpdateDefault, cartSetIdDefault, changelogHandler, createCartHandler, createContentSecurityPolicy, createCustomerAccountClient, createHydrogenContext, createStorefrontClient, createWithCache, formatAPIResult, generateCacheControlHeader, getPaginationVariables, getSelectedProductOptions, getSeoMeta, getShopAnalytics, getSitemap, getSitemapIndex, graphiqlLoader, hydrogenContext, hydrogenPreset, hydrogenRoutes, storefrontRedirect, useAnalytics, useCustomerPrivacy, useNonce, useOptimisticCart, useOptimisticData, useOptimisticVariant };
+export { Analytics, AnalyticsEvent, CacheCustom, CacheLong, CacheNone, CacheShort, CartForm, InMemoryCache, NonceProvider, OptimisticInput, Pagination, RichText, Script, Seo, ShopPayButton, VariantSelector, cartAttributesUpdateDefault, cartBuyerIdentityUpdateDefault, cartCreateDefault, cartDiscountCodesUpdateDefault, cartGetDefault, cartGetIdDefault, cartGiftCardCodesRemoveDefault, cartGiftCardCodesUpdateDefault, cartLinesAddDefault, cartLinesRemoveDefault, cartLinesUpdateDefault, cartMetafieldDeleteDefault, cartMetafieldsSetDefault, cartNoteUpdateDefault, cartSelectedDeliveryOptionsUpdateDefault, cartSetIdDefault, changelogHandler, createCartHandler, createContentSecurityPolicy, createCustomerAccountClient, createHydrogenContext, createRequestHandler, createStorefrontClient, createWithCache, formatAPIResult, generateCacheControlHeader, getPaginationVariables, getSelectedProductOptions, getSeoMeta, getShopAnalytics, getSitemap, getSitemapIndex, graphiqlLoader, hydrogenContext, hydrogenPreset, hydrogenRoutes, storefrontRedirect, useAnalytics, useCustomerPrivacy, useNonce, useOptimisticCart, useOptimisticData, useOptimisticVariant };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map