feat(cart): add visitorConsent support to @inContext directive

[kdaviduik]

WHY are these changes introduced?

Closes https://github.com/Shopify/developer-tools-team/issues/967.

Adds Storefront API 2025-10 parity for the visitorConsent parameter in @inContext directives.

Note: Most Hydrogen storefronts do NOT need this feature. If you're using:

• Hydrogen's analytics provider, or
• Shopify's Customer Privacy API (including third-party consent services integrated with it)

then consent is already handled automatically and you don't need to use this.

This feature is primarily intended for Checkout Kit and other non-Hydrogen integrations that manage consent outside Shopify's standard consent flow.

WHAT is this pull request doing?

Adds visitorConsent support to all cart operations in both @shopify/hydrogen and @shopify/hydrogen-react:

Package	Changes
@shopify/hydrogen	Add visitorConsent to CartOptionalInput type; update all 17 cart mutations/queries with @inContext(visitorConsent: $visitorConsent)
@shopify/hydrogen-react	Update 9 cart queries with visitorConsent variable support

When provided, visitorConsent encodes buyer consent preferences (analytics, marketing, preferences, saleOfData) into the cart's checkoutUrl via the _cs parameter.

HOW to test your changes?

Cart operations now accept visitorConsent as an optional parameter:

await cart.addLines(lines, {
  visitorConsent: {
    marketing: true,
    analytics: true,
    preferences: true,
    saleOfData: false,
  },
});

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation

[kdaviduik]

• feat(cart): add visitorConsent support to @inContext directive #3408 👈 (View in Graphite)
• feat: update SFAPI and CAAPI to 2025-10 #3352 : 6 other dependent PRs (#3284 , #3393 , #3398 and 3 others)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shopify]

Oxygen deployed a preview of your 01-25-feat_cart_add_visitorconsent_support_to_incontext_directive branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 28, 2026 4:38 AM

Learn more about Hydrogen's GitHub integration.

[kdaviduik]

this was missing before. it's present in the other ones