@shopify/hydrogen 2026.4.4 → 2026.4.6

package/dist/development/index.cjs

@@ -235,6 +235,25 @@ function AnalyticsCustomView(props) {
   return /* @__PURE__ */ jsxRuntime.jsx(AnalyticsView, { ...props });
 }
 
+// src/analytics-manager/consent.ts
+function hasAnalyticsConsent() {
+  try {
+    const privacy = window.Shopify?.customerPrivacy;
+    if (privacy?.consentStatus !== "loaded") return false;
+    if (privacy.currentVisitorConsent?.().analytics === "no") return false;
+    return privacy.analyticsProcessingAllowed?.() ?? false;
+  } catch {
+    return false;
+  }
+}
+function shouldWaitForPrivacyBanner(privacy) {
+  if (!privacy.shouldShowBanner()) return false;
+  const consent = privacy.currentVisitorConsent();
+  return ![consent.marketing, consent.analytics, consent.preferences].some(
+    (value) => value === "yes" || value === "no"
+  );
+}
+
 // src/analytics-manager/events.ts
 var AnalyticsEvent = {
   // Views
@@ -250,61 +269,6 @@ var AnalyticsEvent = {
   // Custom
   CUSTOM_EVENT: `custom_`
 };
-
-// src/constants.ts
-var STOREFRONT_REQUEST_GROUP_ID_HEADER = "Custom-Storefront-Request-Group-ID";
-var STOREFRONT_ACCESS_TOKEN_HEADER = "X-Shopify-Storefront-Access-Token";
-var SDK_VARIANT_HEADER = "X-SDK-Variant";
-var SDK_VARIANT_SOURCE_HEADER = "X-SDK-Variant-Source";
-var SDK_VERSION_HEADER = "X-SDK-Version";
-var SHOPIFY_CLIENT_IP_HEADER = "X-Shopify-Client-IP";
-var SHOPIFY_CLIENT_IP_SIG_HEADER = "X-Shopify-Client-IP-Sig";
-var HYDROGEN_SFAPI_PROXY_KEY = "_sfapi_proxy";
-var HYDROGEN_SERVER_TRACKING_KEY = "_server_tracking";
-
-// src/utils/server-timing.ts
-function buildServerTimingHeader(values) {
-  return Object.entries(values).map(([key, value]) => value ? `${key};desc=${value}` : void 0).filter(Boolean).join(", ");
-}
-function appendServerTimingHeader(response, values) {
-  const header = typeof values === "string" ? values : buildServerTimingHeader(values);
-  if (header) {
-    response.headers.append("Server-Timing", header);
-  }
-}
-var trackedTimings = ["_y", "_s", "_cmp"];
-function extractServerTimingHeader(serverTimingHeader) {
-  const values = {};
-  if (!serverTimingHeader) return values;
-  const re = new RegExp(
-    `\\b(${trackedTimings.join("|")});desc="?([^",]+)"?`,
-    "g"
-  );
-  let match;
-  while ((match = re.exec(serverTimingHeader)) !== null) {
-    values[match[1]] = match[2];
-  }
-  return values;
-}
-function hasServerTimingInNavigationEntry(key) {
-  if (typeof window === "undefined") return false;
-  try {
-    const navigationEntry = window.performance.getEntriesByType(
-      "navigation"
-    )[0];
-    return !!navigationEntry?.serverTiming?.some((entry) => entry.name === key);
-  } catch (e) {
-    return false;
-  }
-}
-function isSfapiProxyEnabled() {
-  return hasServerTimingInNavigationEntry(HYDROGEN_SFAPI_PROXY_KEY);
-}
-function hasServerReturnedTrackingValues() {
-  return hasServerTimingInNavigationEntry(HYDROGEN_SERVER_TRACKING_KEY);
-}
-
-// src/customer-privacy/ShopifyCustomerPrivacy.tsx
 var CONSENT_API = "https://cdn.shopify.com/shopifycloud/consent-tracking-api/v0.2/consent-tracking-api.js";
 var CONSENT_API_WITH_BANNER = "https://cdn.shopify.com/shopifycloud/privacy-banner/storefront-banner.js";
 function logMissingConfig(fieldName) {
@@ -312,6 +276,11 @@ function logMissingConfig(fieldName) {
     `[h2:error:useCustomerPrivacy] Unable to setup Customer Privacy API: Missing consent.${fieldName} configuration.`
   );
 }
+function logIgnoredCrossDomainConsent() {
+  console.warn(
+    "[h2:warn:useCustomerPrivacy] `sameDomainForStorefrontApi: false` is ignored. Consent and analytics require the same-origin Storefront API proxy included in Hydrogen's `createRequestHandler`, so consent requests always use it. Remove this option. See https://shopify.dev/changelog/posts/tracking-cookie-deprecation-hydrogen"
+  );
+}
 function useCustomerPrivacy(props) {
   const {
     withPrivacyBanner = false,
@@ -323,27 +292,15 @@ function useCustomerPrivacy(props) {
     locale,
     sameDomainForStorefrontApi
   } = props;
-  const hasSfapiProxy = react.useMemo(
-    () => sameDomainForStorefrontApi ?? isSfapiProxyEnabled(),
-    [sameDomainForStorefrontApi]
-  );
-  const fetchTrackingValuesFromBrowser = react.useMemo(
-    () => hasSfapiProxy && !hasServerReturnedTrackingValues(),
-    [hasSfapiProxy]
-  );
-  const cookiesReady = hydrogenReact.useShopifyCookies({
-    fetchTrackingValues: fetchTrackingValuesFromBrowser,
-    storefrontAccessToken,
-    ignoreDeprecatedCookies: true
-  });
-  const initialTrackingValues = react.useMemo(hydrogenReact.getTrackingValues, [cookiesReady]);
   const { revalidate } = reactRouter.useRevalidator();
-  loadScript.useLoadScript(withPrivacyBanner ? CONSENT_API_WITH_BANNER : CONSENT_API, {
-    attributes: {
-      id: "customer-privacy-api"
-    }
-  });
-  const { observing, setLoaded, apisLoaded } = useApisLoaded({ withPrivacyBanner });
+  const callbacks = react.useRef({ onReady, onVisitorConsentCollected, revalidate });
+  callbacks.current = { onReady, onVisitorConsentCollected, revalidate };
+  const notifiedReady = react.useRef(false);
+  const previousTrackingValues = react.useRef();
+  const [apis, setApis] = react.useState(() => ({
+    customerPrivacy: getCustomerPrivacy(),
+    privacyBanner: getPrivacyBanner()
+  }));
   const config = react.useMemo(() => {
     if (!checkoutDomain) logMissingConfig("checkoutDomain");
     if (!storefrontAccessToken) logMissingConfig("storefrontAccessToken");
@@ -352,196 +309,155 @@ function useCustomerPrivacy(props) {
         `[h2:error:useCustomerPrivacy] It looks like you passed a private access token, make sure to use the public token`
       );
     }
+    if (sameDomainForStorefrontApi === false) logIgnoredCrossDomainConsent();
     const commonAncestorDomain = parseStoreDomain(checkoutDomain);
-    const sfapiDomain = (
-      // Check if standard route proxy is enabled in Hydrogen server
-      // to use it instead of doing a cross-origin request to checkout.
-      hasSfapiProxy && typeof window !== "undefined" ? window.location.host : checkoutDomain
-    );
-    const config2 = {
-      // This domain is used to send requests to SFAPI for setting and getting consent.
-      checkoutRootDomain: sfapiDomain,
-      // Prefix with a dot to ensure this domain is different from checkoutRootDomain.
-      // This will ensure old cookies are set for a cross-subdomain checkout setup
-      // so that we keep backward compatibility until new cookies are rolled out.
-      // Once consent-tracking-api is updated to not rely on cookies anymore, we can remove this.
+    return {
+      // Always the same-origin proxy: cross-origin consent requests carry no
+      // cookies, so consent and visitor tokens would reset on every page load
+      // (and an opt-out would be forgotten). The server render never sends
+      // consent requests, so it keeps the checkout domain.
+      checkoutRootDomain: typeof window !== "undefined" ? window.location.host : checkoutDomain,
       storefrontRootDomain: commonAncestorDomain ? "." + commonAncestorDomain : void 0,
       storefrontAccessToken,
       country,
       locale
     };
-    return config2;
   }, [
-    logMissingConfig,
+    sameDomainForStorefrontApi,
     checkoutDomain,
     storefrontAccessToken,
     country,
     locale
   ]);
   react.useEffect(() => {
-    const consentCollectedHandler = (event) => {
-      const latestTrackingValues = hydrogenReact.getTrackingValues();
-      if (initialTrackingValues.visitToken !== latestTrackingValues.visitToken || initialTrackingValues.uniqueToken !== latestTrackingValues.uniqueToken) {
-        revalidate().catch(() => {
+    let active = true;
+    const shopify = window.Shopify ??= {};
+    const privacy = shopify.customerPrivacy ??= {};
+    privacy.config = {
+      ...privacy.config,
+      isHeadless: true,
+      asyncConsent: true,
+      asyncVisitorState: true,
+      consentDomain: config.checkoutRootDomain,
+      storefrontAccessToken: config.storefrontAccessToken,
+      debug: {
+        ...privacy.config?.debug,
+        hydrogen: HYDROGEN_DEBUG_METADATA
+      }
+    };
+    if (config.country) shopify.country = config.country;
+    if (config.locale) shopify.locale = config.locale.toLowerCase();
+    const updateTrackingValues = () => {
+      const latest = hydrogenReact.getTrackingValues();
+      const previous = previousTrackingValues.current;
+      previousTrackingValues.current = latest;
+      if (previous && (previous.visitToken !== latest.visitToken || previous.uniqueToken !== latest.uniqueToken)) {
+        callbacks.current.revalidate().catch(() => {
           console.warn(
             "[h2:warn:useCustomerPrivacy] Revalidation failed after consent change."
           );
         });
       }
-      if (onVisitorConsentCollected) {
-        const customerPrivacy = getCustomerPrivacy();
-        if (customerPrivacy?.shouldShowBanner()) {
-          const consentValues = customerPrivacy.currentVisitorConsent();
-          if (consentValues) {
-            const NO_VALUE = "";
-            const noInteraction = consentValues.marketing === NO_VALUE && consentValues.analytics === NO_VALUE && consentValues.preferences === NO_VALUE;
-            if (noInteraction) {
-              return;
-            }
-          }
-        }
-        onVisitorConsentCollected(event.detail);
+    };
+    const checkReady = () => {
+      if (!active) return false;
+      const customerPrivacy = getCustomerPrivacy();
+      const privacyBanner = getPrivacyBanner();
+      if (customerPrivacy) configureCustomerPrivacy(customerPrivacy, config);
+      if (withPrivacyBanner && privacyBanner) {
+        configurePrivacyBanner(privacyBanner, config);
+      }
+      setApis(
+        (previous) => previous.customerPrivacy === customerPrivacy && previous.privacyBanner === privacyBanner ? previous : { customerPrivacy, privacyBanner }
+      );
+      if (customerPrivacy?.consentStatus !== "loaded" || withPrivacyBanner && !privacyBanner) {
+        return false;
       }
+      if (!notifiedReady.current) {
+        notifiedReady.current = true;
+        updateTrackingValues();
+        emitCustomerPrivacyApiLoaded(customerPrivacy);
+        callbacks.current.onReady?.();
+      }
+      return true;
     };
+    const consentCollectedHandler = (event) => {
+      if (!checkReady()) return;
+      updateTrackingValues();
+      callbacks.current.onVisitorConsentCollected?.(event.detail);
+    };
+    document.addEventListener("consentTrackingApiLoaded", checkReady);
     document.addEventListener(
       "visitorConsentCollected",
       consentCollectedHandler
     );
+    if (!checkReady()) {
+      void loadScript.loadScript(
+        withPrivacyBanner ? CONSENT_API_WITH_BANNER : CONSENT_API,
+        {
+          attributes: { id: "customer-privacy-api" }
+        }
+      ).then(checkReady, () => {
+        if (active) {
+          console.error(
+            "[h2:error:useCustomerPrivacy] Unable to load the Customer Privacy API."
+          );
+        }
+      });
+    }
     return () => {
+      active = false;
+      document.removeEventListener("consentTrackingApiLoaded", checkReady);
       document.removeEventListener(
         "visitorConsentCollected",
         consentCollectedHandler
       );
     };
-  }, [onVisitorConsentCollected]);
-  react.useEffect(() => {
-    if (!withPrivacyBanner || observing.current.privacyBanner) return;
-    observing.current.privacyBanner = true;
-    let customPrivacyBanner = window.privacyBanner || void 0;
-    const privacyBannerWatcher = {
-      configurable: true,
-      get() {
-        return customPrivacyBanner;
-      },
-      set(value) {
-        if (typeof value === "object" && value !== null && "showPreferences" in value && "loadBanner" in value) {
-          customPrivacyBanner = overridePrivacyBannerMethods({
-            privacyBanner: value,
-            config
-          });
-          setLoaded.privacyBanner();
-        }
-      }
-    };
-    Object.defineProperty(window, "privacyBanner", privacyBannerWatcher);
-  }, [
-    withPrivacyBanner,
-    config,
-    overridePrivacyBannerMethods,
-    setLoaded.privacyBanner
-  ]);
-  react.useEffect(() => {
-    if (observing.current.customerPrivacy) return;
-    observing.current.customerPrivacy = true;
-    let backendConsentStub = null;
-    let fullCustomerPrivacy = null;
-    let customShopify = window.Shopify || void 0;
-    Object.defineProperty(window, "Shopify", {
-      configurable: true,
-      get() {
-        return customShopify;
-      },
-      set(value) {
-        if (typeof value === "object" && value !== null && Object.keys(value).length === 0) {
-          customShopify = value;
-          backendConsentStub = { backendConsentEnabled: true };
-          Object.defineProperty(window.Shopify, "customerPrivacy", {
-            configurable: true,
-            get() {
-              return fullCustomerPrivacy ?? backendConsentStub;
-            },
-            set(value2) {
-              if (typeof value2 === "object" && value2 !== null && "setTrackingConsent" in value2) {
-                const customerPrivacy = value2;
-                fullCustomerPrivacy = {
-                  ...customerPrivacy,
-                  // Note: this method is not used by the privacy-banner,
-                  // it bundles its own setTrackingConsent.
-                  setTrackingConsent: overrideCustomerPrivacySetTrackingConsent(
-                    { customerPrivacy, config }
-                  )
-                };
-                customShopify = {
-                  ...customShopify,
-                  customerPrivacy: fullCustomerPrivacy
-                };
-                setLoaded.customerPrivacy();
-              }
-            }
-          });
-        }
-      }
-    });
-  }, [
-    config,
-    overrideCustomerPrivacySetTrackingConsent,
-    setLoaded.customerPrivacy
-  ]);
-  react.useEffect(() => {
-    if (!apisLoaded || !cookiesReady) return;
-    const customerPrivacy = getCustomerPrivacy();
-    if (customerPrivacy && !customerPrivacy.cachedConsent) {
-      const trackingValues = hydrogenReact.getTrackingValues();
-      if (trackingValues.consent) {
-        customerPrivacy.cachedConsent = trackingValues.consent;
-      }
-    }
-    if (withPrivacyBanner) {
-      const privacyBanner = getPrivacyBanner();
-      if (privacyBanner) {
-        privacyBanner.loadBanner(config);
-      }
-    }
-    emitCustomerPrivacyApiLoaded();
-    onReady?.();
-  }, [apisLoaded, cookiesReady]);
-  const result = {
-    customerPrivacy: getCustomerPrivacy()
+  }, [config, withPrivacyBanner]);
+  return {
+    customerPrivacy: apis.customerPrivacy,
+    ...withPrivacyBanner ? { privacyBanner: apis.privacyBanner } : {}
   };
-  if (withPrivacyBanner) {
-    result.privacyBanner = getPrivacyBanner();
-  }
-  return result;
 }
-var hasEmitted = false;
-function emitCustomerPrivacyApiLoaded() {
-  if (hasEmitted) return;
-  hasEmitted = true;
-  const event = new CustomEvent("shopifyCustomerPrivacyApiLoaded");
-  document.dispatchEvent(event);
-}
-function useApisLoaded({ withPrivacyBanner }) {
-  const observing = react.useRef({ customerPrivacy: false, privacyBanner: false });
-  const [apisLoadedArray, setApisLoaded] = react.useState(
-    withPrivacyBanner ? [false, false] : [false]
-  );
-  const apisLoaded = apisLoadedArray.every(Boolean);
-  const setLoaded = {
-    customerPrivacy: () => {
-      if (withPrivacyBanner) {
-        setApisLoaded((prev) => [true, prev[1]]);
-      } else {
-        setApisLoaded(() => [true]);
-      }
-    },
-    privacyBanner: () => {
-      if (!withPrivacyBanner) {
-        return;
-      }
-      setApisLoaded((prev) => [prev[0], true]);
-    }
+var readyApis = /* @__PURE__ */ new WeakSet();
+function emitCustomerPrivacyApiLoaded(customerPrivacy) {
+  if (readyApis.has(customerPrivacy)) return;
+  readyApis.add(customerPrivacy);
+  document.dispatchEvent(new CustomEvent("shopifyCustomerPrivacyApiLoaded"));
+}
+var HYDROGEN_DEBUG_METADATA = { generation: 2, serverTiming: false };
+var configuredCustomerPrivacy = /* @__PURE__ */ new WeakMap();
+function configureCustomerPrivacy(customerPrivacy, config) {
+  const existing = configuredCustomerPrivacy.get(customerPrivacy);
+  if (existing) {
+    existing.config = config;
+    return;
+  }
+  const state = { config };
+  configuredCustomerPrivacy.set(customerPrivacy, state);
+  const original = customerPrivacy.setTrackingConsent;
+  customerPrivacy.setTrackingConsent = (consent, callback) => {
+    const { locale, country, ...headlessConfig } = state.config;
+    const params = {
+      ...headlessConfig,
+      headlessStorefront: true,
+      ...consent
+    };
+    original.call(customerPrivacy, params, callback);
   };
-  return { observing, setLoaded, apisLoaded };
+}
+var configuredPrivacyBanners = /* @__PURE__ */ new WeakMap();
+function configurePrivacyBanner(privacyBanner, config) {
+  const existing = configuredPrivacyBanners.get(privacyBanner);
+  if (existing) {
+    existing.config = config;
+    return;
+  }
+  const state = { config };
+  configuredPrivacyBanners.set(privacyBanner, state);
+  const { loadBanner, showPreferences } = privacyBanner;
+  privacyBanner.loadBanner = (options) => loadBanner.call(privacyBanner, { ...state.config, ...options });
+  privacyBanner.showPreferences = (options) => showPreferences.call(privacyBanner, { ...state.config, ...options });
 }
 function parseStoreDomain(checkoutDomain) {
   if (typeof window === "undefined") return;
@@ -556,64 +472,25 @@ function parseStoreDomain(checkoutDomain) {
   });
   return sameDomainParts.reverse().join(".") || void 0;
 }
-function overrideCustomerPrivacySetTrackingConsent({
-  customerPrivacy,
-  config
-}) {
-  const original = customerPrivacy.setTrackingConsent;
-  const { locale, country, ...rest } = config;
-  function updatedSetTrackingConsent(consent, callback) {
-    original(
-      {
-        ...rest,
-        headlessStorefront: true,
-        ...consent
-      },
-      callback
-    );
-  }
-  return updatedSetTrackingConsent;
-}
-function overridePrivacyBannerMethods({
-  privacyBanner,
-  config
-}) {
-  const originalLoadBanner = privacyBanner.loadBanner;
-  const originalShowPreferences = privacyBanner.showPreferences;
-  function loadBanner(userConfig) {
-    if (typeof userConfig === "object") {
-      originalLoadBanner({ ...config, ...userConfig });
-      return;
-    }
-    originalLoadBanner(config);
-  }
-  function showPreferences(userConfig) {
-    if (typeof userConfig === "object") {
-      originalShowPreferences({ ...config, ...userConfig });
-      return;
-    }
-    originalShowPreferences(config);
-  }
-  return { loadBanner, showPreferences };
-}
 function getCustomerPrivacy() {
   try {
     const cp = window.Shopify?.customerPrivacy;
-    return cp && "setTrackingConsent" in cp ? cp : null;
+    return typeof cp?.setTrackingConsent === "function" ? cp : null;
   } catch (e) {
     return null;
   }
 }
 function getPrivacyBanner() {
   try {
-    return window && window?.privacyBanner ? window.privacyBanner : null;
+    const banner = window.privacyBanner;
+    return typeof banner?.loadBanner === "function" && typeof banner.showPreferences === "function" ? banner : null;
   } catch (e) {
     return null;
   }
 }
 
 // package.json
-var version = "2026.4.4";
+var version = "2026.4.6";
 
 // src/analytics-manager/ShopifyAnalytics.tsx
 function getCustomerPrivacyRequired() {
@@ -627,47 +504,13 @@ function getCustomerPrivacyRequired() {
 }
 function ShopifyAnalytics({
   consent,
-  onReady,
-  domain
+  onConsentChange
 }) {
-  const { subscribe: subscribe2, register: register2, canTrack } = useAnalytics();
-  const [shopifyReady, setShopifyReady] = react.useState(false);
+  const { subscribe: subscribe2, register: register2 } = useAnalytics();
   const [privacyReady, setPrivacyReady] = react.useState(false);
-  const [collectedConsent, setCollectedConsent] = react.useState("");
   const init = react.useRef(false);
   const { checkoutDomain, storefrontAccessToken, language } = consent;
   const { ready: shopifyAnalyticsReady } = register2("Internal_Shopify_Analytics");
-  useCustomerPrivacy({
-    ...consent,
-    locale: language,
-    checkoutDomain: !checkoutDomain ? "mock.shop" : checkoutDomain,
-    storefrontAccessToken: !storefrontAccessToken ? "abcdefghijklmnopqrstuvwxyz123456" : storefrontAccessToken,
-    // If we use privacy banner, we should wait until consent is collected.
-    // Otherwise, we can consider privacy ready immediately:
-    onReady: () => !consent.withPrivacyBanner && setPrivacyReady(true),
-    onVisitorConsentCollected: (consent2) => {
-      try {
-        setCollectedConsent(JSON.stringify(consent2));
-      } catch (e) {
-      }
-      setPrivacyReady(true);
-    }
-  });
-  const hasUserConsent = react.useMemo(
-    // must be initialized with true to avoid removing cookies too early
-    () => privacyReady ? canTrack() : true,
-    // Make this value depend on collectedConsent to re-run `canTrack()` when consent changes
-    [privacyReady, canTrack, collectedConsent]
-  );
-  hydrogenReact.useShopifyCookies({
-    hasUserConsent,
-    domain,
-    checkoutDomain,
-    // Already done inside useCustomerPrivacy
-    fetchTrackingValues: false,
-    // Avoid creating local cookies too early
-    ignoreDeprecatedCookies: !privacyReady
-  });
   react.useEffect(() => {
     if (init.current) return;
     init.current = true;
@@ -676,14 +519,28 @@ function ShopifyAnalytics({
     subscribe2(AnalyticsEvent.COLLECTION_VIEWED, collectionViewHandler);
     subscribe2(AnalyticsEvent.SEARCH_VIEWED, searchViewHandler);
     subscribe2(AnalyticsEvent.PRODUCT_ADD_TO_CART, productAddedToCartHandler);
-    setShopifyReady(true);
   }, [subscribe2]);
+  const updatePrivacyReadiness = () => {
+    if (privacyReady) {
+      onConsentChange();
+    } else if (!consent.withPrivacyBanner || !shouldWaitForPrivacyBanner(getCustomerPrivacyRequired())) {
+      setPrivacyReady(true);
+    }
+  };
+  useCustomerPrivacy({
+    ...consent,
+    locale: language,
+    checkoutDomain: !checkoutDomain ? "mock.shop" : checkoutDomain,
+    storefrontAccessToken: !storefrontAccessToken ? "abcdefghijklmnopqrstuvwxyz123456" : storefrontAccessToken,
+    onReady: updatePrivacyReadiness,
+    onVisitorConsentCollected: updatePrivacyReadiness
+  });
   react.useEffect(() => {
-    if (shopifyReady && privacyReady) {
+    if (privacyReady) {
       shopifyAnalyticsReady();
-      onReady();
+      onConsentChange();
     }
-  }, [shopifyReady, privacyReady, onReady]);
+  }, [privacyReady, onConsentChange]);
   return null;
 }
 function logMissingConfig2(fieldName) {
@@ -693,7 +550,8 @@ function logMissingConfig2(fieldName) {
 }
 function prepareBasePageViewPayload(payload) {
   const customerPrivacy = getCustomerPrivacyRequired();
-  const hasUserConsent = customerPrivacy.analyticsProcessingAllowed();
+  const hasUserConsent = hasAnalyticsConsent();
+  if (!hasUserConsent) return;
   if (!payload?.shop?.shopId) {
     logMissingConfig2("shopId");
     return;
@@ -1134,13 +992,6 @@ function register(key) {
     }
   };
 }
-function shopifyCanTrack() {
-  try {
-    return window.Shopify.customerPrivacy?.analyticsProcessingAllowed?.() ?? false;
-  } catch (e) {
-  }
-  return false;
-}
 function messageOnError(field, envVar) {
   return `[h2:error:Analytics.Provider] - ${field} is required. Make sure ${envVar} is defined in your environment variables. See https://h2o.fyi/analytics/consent to learn how to setup environment variables in the Shopify admin.`;
 }
@@ -1150,18 +1001,17 @@ function AnalyticsProvider({
   children,
   consent,
   customData = {},
-  shop: shopProp = null,
-  cookieDomain
+  shop: shopProp = null
 }) {
   const { shop } = useShopAnalytics(shopProp);
-  const [analyticsLoaded, setAnalyticsLoaded] = react.useState(
-    customCanTrack ? true : false
-  );
-  const [consentCollected, setConsentCollected] = react.useState(false);
+  const [consentVersion, setConsentVersion] = react.useState(0);
+  const [privacyReady, setPrivacyReady] = react.useState(false);
   const [carts, setCarts] = react.useState({ cart: null, prevCart: null });
-  const [canTrack, setCanTrack] = react.useState(
-    customCanTrack ? () => customCanTrack : () => shopifyCanTrack
-  );
+  const canTrack = customCanTrack ?? hasAnalyticsConsent;
+  const onConsentChange = react.useCallback(() => {
+    setPrivacyReady(true);
+    setConsentVersion((version2) => version2 + 1);
+  }, []);
   if (!!shop) {
     if (/\/68817551382$/.test(shop.shopId)) {
       warnOnce(
@@ -1207,7 +1057,7 @@ function AnalyticsProvider({
       privacyBanner: getPrivacyBanner()
     };
   }, [
-    analyticsLoaded,
+    consentVersion,
     canTrack,
     carts,
     carts.cart?.updatedAt,
@@ -1225,21 +1075,8 @@ function AnalyticsProvider({
     children,
     !!shop && /* @__PURE__ */ jsxRuntime.jsx(AnalyticsPageView, {}),
     !!shop && !!currentCart && /* @__PURE__ */ jsxRuntime.jsx(CartAnalytics, { cart: currentCart, setCarts }),
-    !!shop && /* @__PURE__ */ jsxRuntime.jsx(
-      ShopifyAnalytics,
-      {
-        consent,
-        onReady: () => {
-          setAnalyticsLoaded(true);
-          setCanTrack(
-            customCanTrack ? () => customCanTrack : () => shopifyCanTrack
-          );
-          setConsentCollected(true);
-        },
-        domain: cookieDomain
-      }
-    ),
-    !!shop && consentCollected && /* @__PURE__ */ jsxRuntime.jsx(PerfKit, { shop })
+    !!shop && /* @__PURE__ */ jsxRuntime.jsx(ShopifyAnalytics, { consent, onConsentChange }),
+    !!shop && privacyReady && /* @__PURE__ */ jsxRuntime.jsx(PerfKit, { shop })
   ] });
 }
 function useAnalytics() {
@@ -1304,6 +1141,17 @@ var Analytics = {
   SearchView: AnalyticsSearchView
 };
 
+// src/constants.ts
+var STOREFRONT_REQUEST_GROUP_ID_HEADER = "Custom-Storefront-Request-Group-ID";
+var STOREFRONT_ACCESS_TOKEN_HEADER = "X-Shopify-Storefront-Access-Token";
+var SDK_VARIANT_HEADER = "X-SDK-Variant";
+var SDK_VARIANT_SOURCE_HEADER = "X-SDK-Variant-Source";
+var SDK_VERSION_HEADER = "X-SDK-Version";
+var SHOPIFY_CLIENT_IP_HEADER = "X-Shopify-Client-IP";
+var SHOPIFY_CLIENT_IP_SIG_HEADER = "X-Shopify-Client-IP-Sig";
+var HYDROGEN_SFAPI_PROXY_KEY = "_sfapi_proxy";
+var STOREFRONT_CONSENT_MANAGEMENT_HEADER = "Shopify-Storefront-Consent-Management";
+
 // src/utils/request.ts
 function getHeader(request, key) {
   return getHeaderValue(request.headers, key);
@@ -2009,7 +1857,7 @@ function generateUUID() {
 }
 
 // src/version.ts
-var LIB_VERSION = "2026.4.4";
+var LIB_VERSION = "2026.4.6";
 
 // src/utils/graphql.ts
 function minifyQuery(string) {
@@ -2270,8 +2118,7 @@ function createStorefrontClient(options) {
       streamConfig,
       onRawHeaders: (headers2) => {
         collectedSubrequestHeaders ??= {
-          setCookie: headers2.getSetCookie(),
-          serverTiming: headers2.get("server-timing") ?? ""
+          setCookie: headers2.getSetCookie()
         };
       }
     });
@@ -2404,6 +2251,10 @@ function createStorefrontClient(options) {
               "origin",
               "referer",
               "user-agent",
+              // The marker identifies headless consent-management traffic
+              // to the backend, so the proxy forwards it upstream with the
+              // rest of the allowlisted set.
+              STOREFRONT_CONSENT_MANAGEMENT_HEADER,
               STOREFRONT_ACCESS_TOKEN_HEADER,
               hydrogenReact.SHOPIFY_UNIQUE_TOKEN_HEADER,
               hydrogenReact.SHOPIFY_VISIT_TOKEN_HEADER
@@ -2432,7 +2283,9 @@ function createStorefrontClient(options) {
             headers: forwardedHeaders
           }
         );
-        return new Response(sfapiResponse.body, sfapiResponse);
+        const proxyResponse = new Response(sfapiResponse.body, sfapiResponse);
+        proxyResponse.headers.delete("server-timing");
+        return proxyResponse;
       },
       /**
        * Checks if the request is targeting the Storefront MCP endpoint.
@@ -2481,7 +2334,9 @@ function createStorefrontClient(options) {
             body: request.body,
             headers: forwardedHeaders
           });
-          return new Response(mcpResponse.body, mcpResponse);
+          const proxyResponse = new Response(mcpResponse.body, mcpResponse);
+          proxyResponse.headers.delete("server-timing");
+          return proxyResponse;
         } catch (error) {
           const JSON_RPC_INTERNAL_ERROR = -32603;
           const message = error instanceof Error ? error.message : "Internal proxy error";
@@ -2504,21 +2359,6 @@ function createStorefrontClient(options) {
             response.headers.append("Set-Cookie", value);
           }
         }
-        const serverTiming = extractServerTimingHeader(
-          collectedSubrequestHeaders?.serverTiming
-        );
-        const isDocumentResponse = response.headers.get("content-type")?.startsWith("text/html");
-        const fallbackValues = isDocumentResponse ? { _y: uniqueToken, _s: visitToken } : void 0;
-        appendServerTimingHeader(response, {
-          ...fallbackValues,
-          ...serverTiming
-        });
-        if (isDocumentResponse && collectedSubrequestHeaders && // _shopify_essential cookie is always set, but we need more than that
-        collectedSubrequestHeaders.setCookie.length > 1 && serverTiming?._y && serverTiming?._s && serverTiming?._cmp) {
-          appendServerTimingHeader(response, {
-            [HYDROGEN_SERVER_TRACKING_KEY]: "1"
-          });
-        }
       }
     }
   };
@@ -3780,11 +3620,13 @@ async function refreshToken({
   const customerAccount = session.get(CUSTOMER_ACCOUNT_SESSION_KEY);
   const refreshToken2 = customerAccount?.refreshToken;
   const idToken = customerAccount?.idToken;
-  if (!refreshToken2)
+  if (!refreshToken2) {
+    clearSession(session);
     throw new BadRequest(
       "Unauthorized",
       "No refreshToken found in the session. Make sure your session is configured correctly and passed to `createCustomerAccountClient`."
     );
+  }
   newBody.append("grant_type", "refresh_token");
   newBody.append("refresh_token", refreshToken2);
   newBody.append("client_id", customerAccountId);
@@ -3809,6 +3651,9 @@ async function refreshToken({
   });
   if (!response.ok) {
     const text = await response.text();
+    if (getOAuthError(text) === "invalid_grant") {
+      clearSession(session);
+    }
     throw new Response(text, {
       status: response.status,
       headers: {
@@ -3819,9 +3664,13 @@ async function refreshToken({
   const {
     access_token,
     expires_in,
-    refresh_token
+    refresh_token,
+    error
   } = await response.json();
   if (!access_token || access_token.length === 0) {
+    if (error === "invalid_grant") {
+      clearSession(session);
+    }
     throw new BadRequest("Unauthorized", "Invalid access token received.");
   }
   session.set(CUSTOMER_ACCOUNT_SESSION_KEY, {
@@ -3858,7 +3707,6 @@ async function checkExpires({
       await locks.refresh;
       delete locks.refresh;
     } catch (error) {
-      clearSession(session);
       if (error && error.status !== 401) {
         throw error;
       } else {
@@ -3870,6 +3718,14 @@ async function checkExpires({
     }
   }
 }
+function getOAuthError(body) {
+  try {
+    const data = JSON.parse(body);
+    return typeof data?.error === "string" ? data.error : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function generateCodeVerifier() {
   const rando = generateRandomCode();
   return base64UrlEncode(rando);
@@ -3897,9 +3753,7 @@ function convertBufferToString(hash) {
   return String.fromCharCode(...numberArray);
 }
 function generateState() {
-  const timestamp = Date.now().toString();
-  const randomString = Math.random().toString(36).substring(2);
-  return timestamp + randomString;
+  return base64UrlEncode(generateRandomCode());
 }
 async function exchangeAccessToken(authAccessToken, customerAccountId, customerAccountTokenExchangeUrl, httpsOrigin, debugInfo) {
   const clientId = customerAccountId;
@@ -4053,6 +3907,8 @@ function createCustomerAccountHelper(customerApiVersion, shopId) {
 
 // src/customer/customer.ts
 var HYDROGEN_TUNNEL_DOMAIN_SUFFIX = ".tryhydrogen.dev";
+var OAUTH_RECOVERY_PARAM = "oauth_recovery";
+var OAUTH_RECOVERY_STATE_PREFIX = "oauth-recovery.";
 function checkTunnelDomain(hostname, useCustomAuthDomain, redirectUri) {
   if (hostname.endsWith(HYDROGEN_TUNNEL_DOMAIN_SUFFIX)) return;
   if (useCustomAuthDomain) {
@@ -4284,7 +4140,8 @@ function createCustomerAccountClient({
       ensureTunnel(requestUrl.hostname);
       ifInvalidCredentialThrowError();
       const loginUrl = new URL(getCustomerAccountUrl("AUTH" /* AUTH */));
-      const state = generateState();
+      const isOAuthRecovery = requestUrl.searchParams.get(OAUTH_RECOVERY_PARAM) === "true";
+      const state = `${isOAuthRecovery ? OAUTH_RECOVERY_STATE_PREFIX : ""}${generateState()}`;
       const nonce = generateNonce();
       loginUrl.searchParams.set("client_id", customerAccountId);
       loginUrl.searchParams.set("scope", "openid email");
@@ -4373,17 +4230,30 @@ function createCustomerAccountClient({
       const code = requestUrl.searchParams.get("code");
       const state = requestUrl.searchParams.get("state");
       if (!code || !state) {
-        clearSession(session);
         throw new BadRequest(
           "Unauthorized",
           "No code or state parameter found in the redirect URL."
         );
       }
-      if (session.get(CUSTOMER_ACCOUNT_SESSION_KEY)?.state !== state) {
-        clearSession(session);
-        throw new BadRequest(
-          "Unauthorized",
-          "The session state does not match the state parameter. Make sure that the session is configured correctly and passed to `createCustomerAccountClient`."
+      const customerAccountSession = session.get(CUSTOMER_ACCOUNT_SESSION_KEY);
+      if (customerAccountSession?.state !== state) {
+        if (state.startsWith(OAUTH_RECOVERY_STATE_PREFIX)) {
+          throw new BadRequest(
+            "Unable to complete sign in. Please try again.",
+            "The session state does not match the state parameter. Make sure that the session is configured correctly and passed to `createCustomerAccountClient`."
+          );
+        }
+        warnOnce(
+          "[h2:warn:customerAccount] OAuth callback state mismatch. Restarting customer login once."
+        );
+        const recoveryLoginUrl = new URL(loginPath, request.url);
+        recoveryLoginUrl.searchParams.set(
+          "return_to",
+          customerAccountSession?.redirectPath ?? defaultRedirectPath
+        );
+        recoveryLoginUrl.searchParams.set(OAUTH_RECOVERY_PARAM, "true");
+        return redirect(
+          `${recoveryLoginUrl.pathname}${recoveryLoginUrl.search}`
         );
       }
       const clientId = customerAccountId;
@@ -4650,6 +4520,19 @@ function createHydrogenContext(options, additionalContext) {
   });
   return hybridProvider;
 }
+
+// src/utils/server-timing.ts
+function buildServerTimingHeader(values) {
+  return Object.entries(values).map(([key, value]) => value ? `${key};desc=${value}` : void 0).filter(Boolean).join(", ");
+}
+function appendServerTimingHeader(response, values) {
+  const header = typeof values === "string" ? values : buildServerTimingHeader(values);
+  if (header) {
+    response.headers.append("Server-Timing", header);
+  }
+}
+
+// src/createRequestHandler.ts
 function createRequestHandler({
   build,
   mode,
@@ -6164,7 +6047,7 @@ function renderTitle(template, title) {
   return template.replace("%s", title ?? "");
 }
 function inferMimeType(url) {
-  const ext = url && url.split(".").pop();
+  const ext = url && url.split(/[?#]/)[0].split(".").pop()?.toLowerCase();
   switch (ext) {
     case "svg":
       return "image/svg+xml";