v3.20.0 (retail-react-app@10.2.0 and commerce-sdk-react@5.4.0)

PWA Kit 3.20.0 fixes Trusted Agent (Order on Behalf) login, expands the Commerce Client Shopper Agent widget with new configuration and UI options, cuts SSR runtime cost by removing per-request CloudWatch metrics, hardens session-token handling on load, and corrects a Data Cloud recommender field name.

Highlights

• 🤝 Trusted Agent (Order on Behalf) login fix — The Trusted Agent login popup no longer hangs blank. authorizeTrustedAgent now sends an OAuth state (a CSRF nonce) that the storefront callback requires, and useTrustedAgent verifies it. Delivery also moved to a same-origin postMessage (with a BroadcastChannel fallback), so login completes even under a Cross-Origin-Opener-Policy: same-origin header. (#3976, #3959)
• 🤖 Commerce Client Shopper Agent widget — New floating action button (cc_showFab), component overrides (cc_overridesUrl / cc_overrides), page-push layout (cc_pagePush), escalation/transcript toggles, panel open-state persistence, cc_cdnVersion bundle resolution, and cc_-prefixed config namespacing. (#3966, #3963, #3926)
• 💸 SSR cost reduction — Removed the custom per-request CloudWatch metrics from the SSR server to eliminate the per-request PutMetricData cost. Backward-compatible: app.sendMetric() and MetricsSender are retained as no-ops. (#3962)
• 🛡️ Resilient session-token handling — A stale or malformed session token on load no longer throws Invalid token specified: missing part #2; the flow clears the bad token and falls back to a refresh / guest login. (#3931)
• 📊 Data Cloud recommender fix — Corrects the catalog event field name personalizationContextId → personalizationContentId so the recommender UUID is no longer dropped on ingest. (#3952)

---

Package Changes

@salesforce/commerce-sdk-react@5.4.0

• [Bugfix] Fix Trusted Agent (Order on Behalf) login hanging on a blank popup because authorizeTrustedAgent never sent an OAuth state. authorizeTrustedAgent now generates a CSRF state (a nonce distinct from the PKCE code verifier), sends it on the authorize request, and returns it; useTrustedAgent compares the popup-echoed state against the one it minted before exchanging the code, and SLAS additionally binds state↔code on the token request. #3976
• [Bugfix] Fix Trusted Agent (Order on Behalf) login failing when the storefront sends a Cross-Origin-Opener-Policy: same-origin header. useTrustedAgent now receives the result out of band via postMessage from the same-origin callback page with a BroadcastChannel fallback, and no longer treats a severed popup.closed as user cancellation. Exposes a useTrustedAgentPopupCallback hook for the callback page. Adds TRUSTED_AGENT_RUNBOOK.md. #3959
• [Bugfix] Gracefully handle stale or malformed session tokens on load. An undecodable access token is discarded (and its cookie cleared) and treated as expired, an undecodable SFRA cc-at handoff token is cleared with a fallback to the local store, and a malformed fetchedToken is ignored — in every case the flow falls through to a refresh / guest login instead of throwing. Only affects non-HttpOnly / SSR / hybrid mode. #3931

@salesforce/pwa-kit-runtime@3.20.0

• Remove the custom per-request CloudWatch metrics emitted by the SSR remote server (GCTime, RequestTime, RequestSuccess, RequestFailed*, LambdaCreated, LambdaReused, RenderTime, RenderErrors) to eliminate the PutMetricData cost incurred on every request. Not a breaking change: app.sendMetric() and the MetricsSender (send()/flush()) are retained with their original signatures as no-ops. #3962

@salesforce/pwa-kit-dev@3.20.0

• The dev server's app.sendMetric() is now a backwards-compatible no-op, following removal of custom per-request CloudWatch metrics in pwa-kit-runtime. #3962

@salesforce/pwa-kit-create-app@3.20.0

• [Bugfix] Keep the generated ssr.js.hbs and request-processor.js templates in sync with template-retail-react-app for the Trusted Agent (Order on Behalf) callback fix. The request processor now keeps code on a /callback request when state is also present, and the generated /callback handler serves that variant with Cache-Control: no-store so the callback page can post the result back to the opener, while the standard SLAS redirect stays CDN cacheable. #3959

@salesforce/pwa-kit-react-sdk@3.20.0

• Version-alignment release; no functional changes to pwa-kit-react-sdk since v3.19.0.

@salesforce/retail-react-app@10.2.0

Features

• Add cc_showFab for the Commerce Client shopper-agent widget: when 'true', renders a floating action button at cc_widgetPosition that opens the agent panel and hides while it is open. Defaults to 'false'. #3966
• Add component overrides for the Commerce Client shopper-agent widget: set cc_overridesUrl (HTTPS URL of a hosted override script) or cc_overrides (inline map of override keys to registered custom-element tag names). Mutually exclusive — cc_overrides wins when both are set. A valid cc_overridesUrl origin is added to the script-src CSP directive. #3963
• Persist the Commerce Client shopper-agent panel's open-state to sessionStorage so it stays open across page navigations until the shopper closes it.
• Add configurable cc_enableEscalationToAgent and cc_enableDownloadTranscript toggles (both default 'true') to hide the human-agent escalation control or the transcript-download control.
• Add cc_pagePush: when enabled, storefront content shifts aside (desktop lg+ only) to make room for the open full-height side panel instead of being overlaid, and follows the panel across left/right moves.
• Resolve the Commerce Client messaging bundle URL from a cc_cdnVersion interpolated into the Cimulate CDN, with commerceClientScriptSourceUrl as an explicit override for local dev / self-hosting.
• Namespace all Commerce Client shopper-agent config-input properties under a cc_ prefix (e.g. cc_esDeveloperName, cc_dialogFullHeight, cc_widgetPosition, cc_isOpen) to disambiguate them from the shared/MIAW fields in COMMERCE_AGENT_SETTINGS.

Bug fixes

• [Bugfix] Fix the Data Cloud recommender catalog event field name: personalizationContextId → personalizationContentId. The Context spelling did not match the @salesforce/cc-datacloud-typescript SDK type, so the recommender UUID (__recoUUID) was sent under a key Data Cloud does not recognize and is expected to be dropped on ingest. #3952
• [Bugfix] Deliver the Trusted Agent (Order on Behalf) result from the /callback page back to the opener. The request processor now keeps code when state is also present (the Trusted Agent redirect) and serves it Cache-Control: no-store; the callback page posts code and state to the opener via postMessage (scoped to its origin) with a BroadcastChannel fallback, so login completes even under a Cross-Origin-Opener-Policy: same-origin header. The standard SLAS login redirect carries no state, so it stays CDN cacheable. #3959
• [Bugfix] Honor cc_dialogFullHeight: 'false', which was previously dropped from the widget options so the bundle's full-height default always won.
• [Bugfix] Remove the cc_pagePush content shift while the panel is expanded into a modal, instead of leaving the storefront pushed aside under the centered overlay.

@salesforce/pwa-kit-mcp@0.5.0

• No change this release; already published on npm.

Full Changelog: v3.19.0...v3.20.0

v3.19.0 (retail-react-app@10.1.0 and commerce-sdk-react@5.3.0)

PWA Kit 3.19.0 introduces full Order Management (returns, cancellation, and tracking) on the storefront, expands the Shopper Agent with authenticated customer context, adds SSR distributed tracing and a maintenance-mode experience, continues hardening the opt-in HttpOnly session-cookie mode, and delivers important security upgrades.

🛒 OMS Shopper Orders (Order Management)

• Order tracking — per-shipment OrderTracking card (carrier/method name, localized shipment status, tracking-number link, expected/actual delivery dates from omsData.shipments[]), a "Track Shipment" order action (single button / multi-shipment dropdown / disabled state), per-shipment item boxes on the order-detail page, and a safe external-URL helper. #3865 #3867 #3872 #3898 #3906
• Order-action hooks — cancelOmsOrder / returnOmsOrder mutations and the getOmsMetaData query (return/cancel reason codes) with cache invalidation. #3864 #3869
• Item-level order returns on the order-detail page — a modal with per-item quantity + reason, inline feedback, and a return-progress status badge (handles partially-returned multi-unit lines). #3904
• Cancel order modal for not-yet-shipped OMS-managed orders, with reason-code selection. #3861
• getOrderDisplayStatus util aggregating item-level OMS statuses into a single order-level display status. #3900
• Bumped commerce-sdk-isomorphic to 5.4.0 (first stable release with the OMS Shopper Orders endpoints).

🤖 Shopper Agent

• Customer context for Shopper Agent — on conversation start, forwards the shopper's SLAS session to Core's Token Bridge via a same-origin PWA Kit proxy (access token in the body for non-HttpOnly mode; both tokens read server-side from cookies in HttpOnly mode), and resets the messaging session on guest ↔ registered transitions so the agent never inherits a stale identity. #3890
• Commerce Client as an optional shopper-agent provider — a new commerceAgent.provider switch (miaw default vs commerce-client); the Commerce Client UMD bundle is allowlisted to *.cimulate.ai with a configurable display mode. Existing MIAW storefronts are unaffected. #3925

📊 Distributed Tracing

• SSR render-path distributed tracing (production-gated) — a W3C ssr.render server span plus route-match/getProps/render-to-string and per-SCAPI scapi:<name> child spans parented on the incoming traceparent; exposes res.locals.traceparent for outbound propagation. Off → no-op. #3889
• Reports the matched route template as the low-cardinality http.route span attribute. #3917
• The retail template and create-app forward traceparent on CommerceApiProvider so SSR-time SCAPI/SLAS calls carry trace context. #3889

🧰 Maintenance Mode

• MaintenanceError (503) propagated through the SSR and client error pipelines; throwOnMaintenanceHeader: true by default so sfdc_maintenance responses throw automatically. #3827
• Maintenance page — renders a shared CDN-hosted page (default) or a built-in fallback; configured via app.pages.maintenancePage. #3827

🗄️ MRT Data Store

• Added the MrtDataStoreProvider context and useCustomSitePreferences / useCustomGlobalPreferences hooks (SSR-integrated; client reads window.__MRT_DATA_STORE__). #3811
• Bug Fix: aligned the client/server signatures of getCustomSitePreferences / getCustomGlobalPreferences (both async, same params) for React Query + SSR prepass patterns. #3811

🛡️ HttpOnly Session Cookies

• commerceAPI.cookieDomain support — when set, the SLAS proxy attaches Domain= to every Set-Cookie it emits and expires the host-scoped versions for clean migration (mirrors the client-side behavior). #3782
• Bug Fix — SSR token reconstruction (401 on data routes): the SLAS proxy now emits the host-scoped cookie deletion before the real Domain= cookie. On a cookieless SSR load the SDK reconstructs the token from Set-Cookie via last-write-wins per cookie name; the old order let the trailing empty deletion clobber the real token, causing 401s on data-bearing routes (e.g. a PLP deep link). The same fix applies to the refresh token (cc-nx/cc-nx-g).
• SCAPI Authorization pass-through & normalization: a valid Bearer <jwt> is now passed through to SCAPI unchanged (no longer overwritten by a stale/empty cookie), and incoming bearers are normalized to canonical Bearer. Closes cold-tab and hard-refresh 401s on PLP/PDP routes. #3859
• Cookie-metadata migration: SLAS metadata (customer_id, customer_type, enc_user_id, id_token, idp_refresh_token) moved from localStorage to proxy-set cookies; cc-nx-exists + refresh_token_expires_in replaced by a single cc-nx-expires (absolute expiry); added a useCookie hook. customer_id/customer_type now expire with the access token and re-issue on every token response. #3830 #3858
• Refresh-and-retry on SCAPI 401 instead of rendering a hard error page (invalid-but-unexpired token → refresh off the still-valid refresh token, retry once). Applies to both HttpOnly and localStorage modes. #3860
• Preserve SCAPI/SFRA error details — handleInvalidToken reads the error body from a clone so callers can still read details (e.g. an SFRA-hook dw.system.Status.ERROR on a 400).
• Fix stale sfdc_dwsid affinity header in CommerceApiProvider (a missing dwsid dependency could send a stale header, risking wrong/expired app-server routing on hybrid storefronts).

🖼️ Storefront Preview Updates

• Server-only __Host-pwakit_preview_ctx marker cookie set for trusted Runtime Admin iframe loads; adds Partitioned (CHIPS) support to the BFF cookie serializer; CSP now includes staging/preview Runtime Admin hosts. #3850
• SLAS proxy issues session cookies as SameSite=None; Partitioned for trusted preview parents; logout clears the marker. Resolves requestUsid timeout / access_token_cookie_missing 400s inside the preview iframe. #3851
• Follow-on fix: honors an x-pwakit-preview-parent header as an alternate trusted-preview signal for when the cacheable iframe document load is served from CDN cache and bypasses the marker writer.
• Extended IFRAME_HOST_ALLOW_LIST to include the soak and testing Runtime Admin environments. #3850
• Bugfix: Storefront Preview session loss with HttpOnly cookies enabled (the client now sends the trusted parent origin on the never-cached SLAS token request).

⚡ Storefront Performance & UX (retail template)

• SSR-open search refinements panels — replaced the ChakraUI v2 Accordion (which forces items closed in SSR) with a controlled disclosure, removing a post-hydration relayout that could become the PLP largest-contentful-paint element.
• Memoized the search refinements panel to stop needless re-renders. #3855
• PayPal/Venmo express checkout — resolves the buyer-approved address from the upstream PayPal Order and PATCHes the basket payment instrument on shipping-address change so the review screen reflects the new amount and shipping options. #3868
• Sync amount on the basket payment instrument before placing the order so the persisted PaymentTransaction matches orderTotal.
• Carrier tracking links now use rel="noopener noreferrer" so the order-page URL doesn't leak as the Referer.
• Bundle-size budget adjustments: vendor.js 395 → 398 kB, main.js 102 → 103 kB. #3834 #3868

🔒 Security

• Upgraded @salesforce/mrt-utilities ^0.1.6 → ^0.2.2, eliminating the fast-xml-parser dependency and resolving CVE-2026-26278 (Critical) plus CVE-2025-23333, CVE-2024-55565, CVE-2024-41818, CVE-2024-41810, CVE-2023-52426, and CVE-2023-34104 (now on AWS SDK 3.1049.0). #3911
• Upgraded all @opentelemetry/* packages ^1.15.1 → ^2.8.0 to resolve GHSA-8988-4f7v-96qf (unbounded memory allocation). [#3911](#39...

v3.18.1 (retail-react-app@10.0.1 and commerce-sdk-react@5.2.1)

PWA Kit 3.18.1 is a patch release that fixes Page Designer integration, pins a broken dependency, and fixes verdaccio config for generated project tests.

Highlights

• 🧩 Page Designer Integration Fix — Add contentLinkUuid support to fix Page Designer component linking in commerce-sdk-react. (#3839)
• 📦 Verdaccio Fix — Fix verdaccio config to not proxy monorepo @salesforce/* packages, ensuring locally published versions are used in generated project tests. (#3842)
• 🔧 @formatjs/cli Pin — Pin @formatjs/cli to avoid broken native binaries in generated projects.
• ⚛️ react-router Override — Add react-router override for @salesforce/storefront-next-runtime in generated project template. (#3839)

---

Package Changes

@salesforce/commerce-sdk-react@5.2.1

• Add contentLinkUuid support to fix Page Designer integration #3839

@salesforce/pwa-kit-create-app@3.18.1

• Add react-router override for @salesforce/storefront-next-runtime in generated project template #3839
• Fix verdaccio config to not proxy monorepo @salesforce/* packages #3842

@salesforce/pwa-kit-runtime@3.18.1

• Patch version bump (no functional changes)

@salesforce/pwa-kit-react-sdk@3.18.1

• Patch version bump (no functional changes)

@salesforce/pwa-kit-dev@3.18.1

• Patch version bump (no functional changes)

Full Changelog: v3.18.0...v3.18.1

v3.18.0 (retail-react-app@10.0.0 and commerce-sdk-react@5.2.0)

PWA Kit 3.18 ships a security hardening release for the SLAS private-client proxy alongside two opt-in observability/storage features (HttpOnly session cookies, MRT Data Store), a memory-leak fix for warm Lambda invocations, and assorted Express Checkout, cookie-domain, and template polish.

Highlights

• 🔒 SLAS Proxy Security Hardening — The SLAS private-client proxy now enforces a path-and-method allow-list with iterative path normalization. The legacy applySLASPrivateClientToEndpoints option is replaced by slasPrivateClientAllowList, with additional logging and error handling for SLAS error scenarios. (#3802, #3812, #3750)
• 🍪 HttpOnly Session Cookies (WIP, opt-in) — Opt-in support for HttpOnly session cookies to protect SLAS tokens. Disabled by default; enable via enableHttpOnlySessionCookies in ssrParameters. (#3804, #3816)
• 💾 MRT Data Store Integration — Opt-in support for resolving custom site and global preferences from the MRT Data Store during SSR. New getCustomSitePreferences / getCustomGlobalPreferences helpers; local in-memory provider via @salesforce/mrt-utilities conditional exports for dev without DynamoDB. (#3787, #3811)
• 🚀 SSR QueryClient Memory Fix — Fixes SSR QueryClient memory retention across warm Lambda invocations, reducing memory pressure in production. (#3795)
• 🍪 Configurable Auth Cookie Domain — Auth-related cookies domain can now be set via config to support shared-session scenarios across subdomains. (#3782, #3822)
• 💳 Express Checkout Per-Page Toggles + return_url — Per-page express checkout toggles (expressOnCheckoutPagesEnabled) from Shopper Configurations API control express payment buttons on PDP, minicart, cart, and checkout individually. Added return_url for express checkout payment confirmation, required by redirect-based payment methods like Amazon Pay. (#3775, #3803)
• 🌐 Proxy User-Agent Preservation Flag — New option to preserve the original User Agent header in proxy requests. (#3798)
• 🎨 Alert Styling Fix — Fixed alert description text styling on subscribe form to not override default alert styles. (#3780)

---

Package Changes

@salesforce/pwa-kit-runtime@3.18.0

• Add option to keep original User Agent header in proxy requests #3798
• WIP: Add support for HttpOnly session cookies #3804
• Data Store Simplified: Removed internal provider pattern and dynamic loading. Now imports data store directly from @salesforce/mrt-utilities@0.1.6+ via conditional exports (dev-data-store). Local data store uses MRT_DATA_STORE_DEFAULTS and MRT_DATA_STORE_WARN_ON_MISSING (legacy PWAKIT_MRT_DATA_STORE_ENABLED still supported). #3811
• Add isMrtDataStoreEnabled(config) opt-in gate for SSR Data Store bootstrap. Controlled by app.mrtDataStore.enabled or PWAKIT_MRT_DATA_STORE_ENABLED. #3787
• Add getCustomGlobalPreferences / getCustomSitePreferences helpers (server async fetch, client reads window.__MRT_DATA_STORE__). #3787
• The SLAS private-client proxy now enforces a path-and-method allow-list with iterative path normalization. The legacy applySLASPrivateClientToEndpoints option is replaced by slasPrivateClientAllowList. #3802
• Add additional logging and error handling for SLAS error scenarios. #3750
• Refactor: Extract reusable SLAS proxy helpers. #3812
• Fix SSR QueryClient memory retention across warm Lambda invocations. #3795

@salesforce/pwa-kit-react-sdk@3.18.0

• Update @salesforce/pwa-kit-runtime dependency for the simplified data store implementation. #3811
• Add configuration flag enableHttpOnlySessionCookies to ssrParameters (WIP, disabled by default). #3804
• Serialize custom site and global preferences into #mobify-data under __MRT_DATA_STORE__ during SSR when enabled. #3787
• Fix SSR QueryClient memory retention across warm Lambda invocations. #3795

@salesforce/pwa-kit-dev@3.18.0

• Add option to keep original User Agent header in proxy requests. #3798
• WIP: Add support for HttpOnly session cookies. #3804
• Removed mrt-data-store-local-provider.js and related code; local data store now lives in @salesforce/mrt-utilities@0.1.6+. #3811
• Webpack: added dev-data-store to conditionNames in development mode. #3811

@salesforce/pwa-kit-create-app@3.18.0

• Add opt-in app.mrtDataStore.enabled to generated config/default.js templates (default false); local defaults documented via MRT_DATA_STORE_DEFAULTS. #3787 #3811 #3823
• Allow auth related cookies domain to be set via config. #3782
• Update generated app/ssr.js guidance for the SLAS private-client proxy: replace deprecated applySLASPrivateClientToEndpoints example with a pointer to slasPrivateClientAllowList. #3802
• WIP: Add support for HttpOnly session cookies. #3804
• Add Node 24 support to the extensible app template's generated package.json. #3821

@salesforce/commerce-sdk-react@5.2.0

• Allow auth related cookies domain to be set via config. #3782
• WIP: Add support for HttpOnly session cookies. #3804
• Re-add cookieDomain parameter to the Auth constructor; previously dropped during a merge. #3822

@salesforce/retail-react-app@10.0.0

⚠️ Breaking changes

• Major bump from 9.x → 10.0.0 due to component-override breaking changes (express checkout hooks, alert styling, per-page checkout logic). #3818

Features

• Add opt-in app.mrtDataStore.enabled to config/default.js. Local defaults via MRT_DATA_STORE_DEFAULTS. #3787
• Allow auth related cookies domain to be set via config. #3782
• WIP: Add support for HttpOnly session cookies. #3804

Bug fixes

• Fix per-page Express Checkout toggles using expressOnCheckoutPagesEnabled from Shopper Configurations API. #3775
• Add return_url for Express Checkout payment confirmation, required by redirect-based payment methods like Amazon Pay. #3803
• Fix alert description text styling on subscribe form to not override default alert styles. #3780

Documentation

• Update MRT Data Store config comments and README to use the unprefixed env vars actually consumed by @salesforce/mrt-utilities. #3811 #3823
• Update app/ssr.js SLAS private-client proxy guidance: pointer to slasPrivateClientAllowList. #3802

Full Changelog: v3.17.1...v3.18.0

v2.11.0

What's Changed

• Adds Node 24 support. Dropped Node 16
• Updates the ECOM instance a newly generated app points to

Full Changelog: v2.10.0...v2.11.0

v3.17.1 (@salesforce/retail-react-app@9.1.1 and @salesforce/commerce-sdk-react@5.1.1)

This follow up to PWA Kit 3.17.0 adds support for environment base paths.

The environment base path is set on bundle upload and lets you map PWA bundles deployed on MRT environments with a url path prefix. This enables projects to map their PWA applications under sub paths to their domain.

Base paths are set by adding a envBasePath property to the ssrParameters in your default.js config file.
By setting a base path, it is added to express routes such as /mobify or /callback.

If you want to include the base path in your page urls as well, set app.url.showBasePath to true.

Package Changes

@salesforce/retail-react-app@9.1.1

• Update storefront preview to support base paths #3614

@salesforce/commerce-sdk-react@5.1.1

• Update storefront preview to support base paths #3614
• Remove base path from /__pwa-kit route requests when showBasePath is false #3758

@salesforce/pwa-kit-runtime@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614
• Remove base path from /__pwa-kit route requests when showBasePath is false #3758-

@salesforce/pwa-kit-create-app@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

@salesforce/pwa-kit-dev@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

@salesforce/pwa-kit-react-sdk@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

v3.17.0 (@salesforce/retail-react-app@9.1.0 and @salesforce/commerce-sdk-react@5.1.0)

Highlights

💳 Salesforce Payments - Stripe, Adyen, and PayPal payment processing via SF Payments is now available
📝 Page Designer - OOTB support for page desginer in PWA
🚀 : Marketing - Ability to subscriptions to marketing communications have been added to the footer
🛠️ Node 24 support - Node 24 added, Node 16 removed
⬆️ commerce-sdk-isomorphic v5.1.0 Upgrade & Shopper Baskets V2 - To support SF Payments, Retail React App components have been updated to use Shopper Baskets V2

For more details, see PWA Kit 3.17 Changes in the Composable Storefront Developer Guide.

Package Changes

@salesforce/commerce-sdk-react@5.1.0

• Add Page Designer Support #3727
• Bump commerce-sdk-isomorphic to 5.1.0 #3725
  Update ShopperBasketsV2 hooks documentation and query keys #3728
• Add Node 24 support. Drop Node 16 support. #3652
• Add Shopper Consents API support #3674

@salesforce/retail-react-app@9.1.0

• [Bugfix] Fix edirect payment methods status value to pascal #3734
• [Bugfix] Fix in checkout and cart page: LoadingSpinner to have full screen overlay #3730
• [Bugfix] Fix adding to cart from a master product in the wishlist #3732
• Add Page Designer Support #3727
• [Feature] Add Salesforce Payments support in checkout #3725
• One Click Checkout removed from Developer Preview. When shoppers use passwordless OTP login with one-click checkout, the system saves their shipping and payment information for faster checkout in the future. Security safeguards required: (1) Captcha - Protects the passwordless login from bots. (2) OTP for Email Changes - Verifies identity before an email update, prevents accidental account lockouts from typos, and prevents unauthorized access to saved payment methods.
• Update jest-fetch-mock and Jest 29 dependencies #3663
• Add Node 24 support. Drop Node 16 support #3652
• [Bugfix] Fix error toast for no applicable shipping methods in one-click checkout #3673
• [Feature] Subscribe to marketing communications. Email capture component updated in footer section to use Shopper Consents API. #3674
• [Bugfix] Fix for custom billing address as returning shoppers in 1CC #3693
• [Feature] Add translations for text in 1CC #3703

@salesforce/pwa-kit-runtime@3.17.0

• Add Node 24 support. Migrate deprecated Node.js url.parse() and url.format() to the WHATWG URL #3652

@salesforce/pwa-kit-create-app@3.17.0

• Add Salesforce Payments configuration to generated projects [#3725] (#3725)
• Clear verdaccio npm cache during project generation #3652
• Add Node 24 support, remove legacy url module import. Drop Node 16 support #3652
• One Click Checkout removed from Developer Preview. When shoppers use passwordless OTP login with one-click checkout, the system saves their shipping and payment information for faster checkout in the future. Security safeguards required: (1) Captcha - Protects the passwordless login from bots. (2) OTP for Email Changes - Verifies identity before an email update, prevents accidental account lockouts from typos, and prevents unauthorized access to saved payment methods.
• [Bugfix] Add missing dependency overrides to extensible app package.json template to address console warnings on build #3745

@salesforce/pwa-kit-dev@3.17.0

• Add Page Designer Design CSS Support #3727
• Update jest, archiver and remove rimraf dependencies #3663
• Add Node 24 support, remove legacy url module import. Drop Node 16 support #3652

@salesforce/pwa-kit-react-sdk@3.17.0

• Update test setup for Jest 29 compatibility #3663
• Add Node 24 support. Drop Node 16 support #3652

v3.16.0 (@salesforce/retail-react-app@9.0.0 and @salesforce/commerce-sdk-react@5.0.0)

Highlights

• One Click Checkout (Developer Preview) — Streamlined checkout experience with a single click for returning shoppers
• Commerce SDK Isomorphic v5.0.0 — Introduces Payment Instrument SCAPI integration
• Passwordless Login Enhancements — Email mode is now the default for passwordless login and password reset, with configurable mode across login page, auth modal, and checkout
• PWA Integration with OMS — Order Details, Order History, shipping display, and BOPIS multishipment support
• AWS SDK v2 to v3 Migration — Modernized cloud infrastructure dependency in pwa-kit-runtime

---

Enabling One Click Checkout (Developer Preview)

One Click Checkout is shipped as a Developer Preview feature and is disabled by default. To enable it, follow these steps:

Prerequisites

One Click Checkout requires a SLAS private client. If your project is not already configured to use a SLAS private client, follow the setup guide first: Use a SLAS Private Client.

1. Enable the feature flag

In your project's config/default.js, set the oneClickCheckout.enabled flag to true:

// config/default.js
app: {
    // ...existing config
    oneClickCheckout: {
        enabled: true
    }
}

2. Configure the SLAS private client proxy

In your project's ssr.js, add the onSLASPrivateProxyRes callback to the runtime options to handle passwordless login responses correctly:

onSLASPrivateProxyRes: (responseBuffer, proxyRes, req, res) => {
    // Undo the 404 → 200 masking for /oauth2/passwordless/login
    if (req.path?.match(/\/oauth2\/passwordless\/login/) && proxyRes.statusCode === 404) {
        res.statusCode = 404
        res.statusMessage = 'Not Found'
    }
    return responseBuffer
},

Developer Preview Disclaimer

This feature is available as a Developer Preview. Developer Preview features aren't generally available unless or until Salesforce announces general availability in documentation, press releases, or public statements. All commands, parameters, and other features are subject to change or deprecation at any time, with or without notice. Don't implement functionality developed with these commands or tools in production environments.

---

Package Changes

@salesforce/commerce-sdk-react@5.0.0

• Upgrade to commerce-sdk-isomorphic v5.0.0 and introduce Payment Instrument SCAPI integration #3552
• [Bugfix] Ensure code_verifier can be optional in resetPassword call #3567
• [Improvement] Strengthening typescript types on custom endpoint options and fetchOptions types #3589
• [Feature] Update authorizePasswordless, getPasswordResetToken, and resetPassword to support use of email mode #3525

@salesforce/retail-react-app@9.0.0

• [Feature] One Click Checkout (in Developer Preview) #3552
• [Feature] Add fuzzyPathMatching to reduce computational overhead of route generation at time of application load #3530
• [Feature] PWA Integration with OMS
  • Integrate Order Details page to display orders data from OMS #3573
  • Integrate Order History page to display data from OMS #3581
  • Add shipping display support for OMS #3588
  • BOPIS multishipment with OMS #3613
  • Default to ECOM shipments in case OMS has no shipments #3639
• [Feature] Update passwordless login and password reset to use email mode by default. The mode can now be configured across the login page, auth modal, and checkout page #3525
• Update "Continue Securely" button text to "Continue" for passwordless login #3556
• Util function for passwordless callback URI #3630
• Allow shopper to manually input OTP during passwordless login #3554
• [Bugfix] Fix Passwordless Login landingPath, Reset Password landingPath, and Social Login redirectUri value in config not being used #3560
• [BREAKING] Remove unused absoluteUrl util from retail react app #3633

@salesforce/pwa-kit-runtime@3.16.0

• Migrate AWS SDK from v2 to v3 #3566
• Updated the SLAS private client proxy to enable customizing the proxy response body #3662

@salesforce/pwa-kit-create-app@3.16.0

• Add new One-Click Checkout configuration #3609
• Support email mode by default for passwordless login and password reset in a generated app #3525
• Util function for passwordless callback URI #3630
• Add tokenLength to login configuration #3554

@salesforce/pwa-kit-dev@3.16.0

@salesforce/pwa-kit-react-sdk@3.16.0

v3.15.0 (@salesforce/retail-react-app@8.3.0 and @salesforce/commerce-sdk-react@4.3.0)

Highlights

• [#3071] Address Autocompletion feature, powered by Google Maps platform
• [#3071] Commerce SDK Isomorphic upgraded to v4.2.0; introduces support for SCAPI Shopper Configurations API (Included as part of Address Autocomplete)

Bugfixes

• [#3508] Fix multiple set-cookie headers
• [#3493] Fix Forgot Password link not working from Account Profile password update form

v3.14.0 (@salesforce/retail-react-app@8.2.0 and @salesforce/commerce-sdk-react@4.2.0)

Highlights

For release highlights, see PWA Kit 3.14 Changes in the Composable Storefront Developer Guide.

@salesforce/commerce-sdk-react@4.2.0

• Upgrade to commerce-sdk-isomorphic v4.0.1 #3449
• Prevent headers from being overriden in generateCustomEndpointOptions #3405

@salesforce/pwa-kit-create-app@3.14.0

• Prompt text for Site ID should match actual validation: Site ID may contain uppercase or lowercase letters, numbers, hyphens, or underscores. - Updated Site ID validator regex to allow both uppercase and lowercase letters for improved compatibility, clarity. [#3410] (#3410)
• Added Hybrid Proxy support configuration for local and ODS hybrid development [#3409] (#3409)

@salesforce/pwa-kit-dev@3.14.0

@salesforce/pwa-kit-react-sdk@3.14.0

@salesforce/pwa-kit-runtime@3.14.0

• Replace aws-serverless-express with @h4ad/serverless-adapter #3325
• Added Hybrid Proxy support for local and ODS hybrid development [#3409] (#3409)
• Add extensibility hooks for SLAS private client proxy with onSLASPrivateProxyReq and onSLASPrivateProxyRes callbacks #3411

@salesforce/retail-react-app@8.2.0

• Add support for Rule Based Promotions for Choice of Bonus Products. We are currently supporting only one product level rule based promotion per product #3418
• Added Einstein suggestions support for popular and recent searches in search functionality. Users can now see personalized search suggestions based on Einstein AI recommendations. #3422
• [Bugfix] Fix footer heading semantic consistency and alignment. Fix accessibility compliance by adding proper h1 headings to checkout pages to resolve the page-has-heading-one accessibility rule violation. #3398
• [Bugfix] Use serverSafeEncode util for address mutations. #3380
• Added Hybrid Proxy support for local and ODS hybrid development [#3409] (#3409)
• My Account Order Details page correctly shows orders with BOPIS and with Multiple shipments #3414
• Fix bug where pick up items were displaying delivery stock levels instead of in store stock levels #3401
• When registering a guest user on the confirmation page only save the delivery addresses to the new account
  #3412
• Improve mobile layout for StoreDisplay component 3420