v3.20.0 (retail-react-app@10.2.0 and commerce-sdk-react@5.4.0)

PWA Kit 3.20.0 fixes Trusted Agent (Order on Behalf) login, expands the Commerce Client Shopper Agent widget with new configuration and UI options, cuts SSR runtime cost by removing per-request CloudWatch metrics, hardens session-token handling on load, and corrects a Data Cloud recommender field name.

Highlights

• 🤝 Trusted Agent (Order on Behalf) login fix — The Trusted Agent login popup no longer hangs blank. authorizeTrustedAgent now sends an OAuth state (a CSRF nonce) that the storefront callback requires, and useTrustedAgent verifies it. Delivery also moved to a same-origin postMessage (with a BroadcastChannel fallback), so login completes even under a Cross-Origin-Opener-Policy: same-origin header. (#3976, #3959)
• 🤖 Commerce Client Shopper Agent widget — New floating action button (cc_showFab), component overrides (cc_overridesUrl / cc_overrides), page-push layout (cc_pagePush), escalation/transcript toggles, panel open-state persistence, cc_cdnVersion bundle resolution, and cc_-prefixed config namespacing. (#3966, #3963, #3926)
• 💸 SSR cost reduction — Removed the custom per-request CloudWatch metrics from the SSR server to eliminate the per-request PutMetricData cost. Backward-compatible: app.sendMetric() and MetricsSender are retained as no-ops. (#3962)
• 🛡️ Resilient session-token handling — A stale or malformed session token on load no longer throws Invalid token specified: missing part #2; the flow clears the bad token and falls back to a refresh / guest login. (#3931)
• 📊 Data Cloud recommender fix — Corrects the catalog event field name personalizationContextId → personalizationContentId so the recommender UUID is no longer dropped on ingest. (#3952)

---

Package Changes

@salesforce/commerce-sdk-react@5.4.0

• [Bugfix] Fix Trusted Agent (Order on Behalf) login hanging on a blank popup because authorizeTrustedAgent never sent an OAuth state. authorizeTrustedAgent now generates a CSRF state (a nonce distinct from the PKCE code verifier), sends it on the authorize request, and returns it; useTrustedAgent compares the popup-echoed state against the one it minted before exchanging the code, and SLAS additionally binds state↔code on the token request. #3976
• [Bugfix] Fix Trusted Agent (Order on Behalf) login failing when the storefront sends a Cross-Origin-Opener-Policy: same-origin header. useTrustedAgent now receives the result out of band via postMessage from the same-origin callback page with a BroadcastChannel fallback, and no longer treats a severed popup.closed as user cancellation. Exposes a useTrustedAgentPopupCallback hook for the callback page. Adds TRUSTED_AGENT_RUNBOOK.md. #3959
• [Bugfix] Gracefully handle stale or malformed session tokens on load. An undecodable access token is discarded (and its cookie cleared) and treated as expired, an undecodable SFRA cc-at handoff token is cleared with a fallback to the local store, and a malformed fetchedToken is ignored — in every case the flow falls through to a refresh / guest login instead of throwing. Only affects non-HttpOnly / SSR / hybrid mode. #3931

@salesforce/pwa-kit-runtime@3.20.0

• Remove the custom per-request CloudWatch metrics emitted by the SSR remote server (GCTime, RequestTime, RequestSuccess, RequestFailed*, LambdaCreated, LambdaReused, RenderTime, RenderErrors) to eliminate the PutMetricData cost incurred on every request. Not a breaking change: app.sendMetric() and the MetricsSender (send()/flush()) are retained with their original signatures as no-ops. #3962

@salesforce/pwa-kit-dev@3.20.0

• The dev server's app.sendMetric() is now a backwards-compatible no-op, following removal of custom per-request CloudWatch metrics in pwa-kit-runtime. #3962

@salesforce/pwa-kit-create-app@3.20.0

• [Bugfix] Keep the generated ssr.js.hbs and request-processor.js templates in sync with template-retail-react-app for the Trusted Agent (Order on Behalf) callback fix. The request processor now keeps code on a /callback request when state is also present, and the generated /callback handler serves that variant with Cache-Control: no-store so the callback page can post the result back to the opener, while the standard SLAS redirect stays CDN cacheable. #3959

@salesforce/pwa-kit-react-sdk@3.20.0

• Version-alignment release; no functional changes to pwa-kit-react-sdk since v3.19.0.

@salesforce/retail-react-app@10.2.0

Features

• Add cc_showFab for the Commerce Client shopper-agent widget: when 'true', renders a floating action button at cc_widgetPosition that opens the agent panel and hides while it is open. Defaults to 'false'. #3966
• Add component overrides for the Commerce Client shopper-agent widget: set cc_overridesUrl (HTTPS URL of a hosted override script) or cc_overrides (inline map of override keys to registered custom-element tag names). Mutually exclusive — cc_overrides wins when both are set. A valid cc_overridesUrl origin is added to the script-src CSP directive. #3963
• Persist the Commerce Client shopper-agent panel's open-state to sessionStorage so it stays open across page navigations until the shopper closes it.
• Add configurable cc_enableEscalationToAgent and cc_enableDownloadTranscript toggles (both default 'true') to hide the human-agent escalation control or the transcript-download control.
• Add cc_pagePush: when enabled, storefront content shifts aside (desktop lg+ only) to make room for the open full-height side panel instead of being overlaid, and follows the panel across left/right moves.
• Resolve the Commerce Client messaging bundle URL from a cc_cdnVersion interpolated into the Cimulate CDN, with commerceClientScriptSourceUrl as an explicit override for local dev / self-hosting.
• Namespace all Commerce Client shopper-agent config-input properties under a cc_ prefix (e.g. cc_esDeveloperName, cc_dialogFullHeight, cc_widgetPosition, cc_isOpen) to disambiguate them from the shared/MIAW fields in COMMERCE_AGENT_SETTINGS.

Bug fixes

• [Bugfix] Fix the Data Cloud recommender catalog event field name: personalizationContextId → personalizationContentId. The Context spelling did not match the @salesforce/cc-datacloud-typescript SDK type, so the recommender UUID (__recoUUID) was sent under a key Data Cloud does not recognize and is expected to be dropped on ingest. #3952
• [Bugfix] Deliver the Trusted Agent (Order on Behalf) result from the /callback page back to the opener. The request processor now keeps code when state is also present (the Trusted Agent redirect) and serves it Cache-Control: no-store; the callback page posts code and state to the opener via postMessage (scoped to its origin) with a BroadcastChannel fallback, so login completes even under a Cross-Origin-Opener-Policy: same-origin header. The standard SLAS login redirect carries no state, so it stays CDN cacheable. #3959
• [Bugfix] Honor cc_dialogFullHeight: 'false', which was previously dropped from the widget options so the bundle's full-height default always won.
• [Bugfix] Remove the cc_pagePush content shift while the panel is expanded into a modal, instead of leaving the storefront pushed aside under the centered overlay.

@salesforce/pwa-kit-mcp@0.5.0

• No change this release; already published on npm.

Full Changelog: v3.19.0...v3.20.0