v3.19.0 (retail-react-app@10.1.0 and commerce-sdk-react@5.3.0)

PWA Kit 3.19.0 introduces full Order Management (returns, cancellation, and tracking) on the storefront, expands the Shopper Agent with authenticated customer context, adds SSR distributed tracing and a maintenance-mode experience, continues hardening the opt-in HttpOnly session-cookie mode, and delivers important security upgrades.

🛒 OMS Shopper Orders (Order Management)

• Order tracking — per-shipment OrderTracking card (carrier/method name, localized shipment status, tracking-number link, expected/actual delivery dates from omsData.shipments[]), a "Track Shipment" order action (single button / multi-shipment dropdown / disabled state), per-shipment item boxes on the order-detail page, and a safe external-URL helper. #3865 #3867 #3872 #3898 #3906
• Order-action hooks — cancelOmsOrder / returnOmsOrder mutations and the getOmsMetaData query (return/cancel reason codes) with cache invalidation. #3864 #3869
• Item-level order returns on the order-detail page — a modal with per-item quantity + reason, inline feedback, and a return-progress status badge (handles partially-returned multi-unit lines). #3904
• Cancel order modal for not-yet-shipped OMS-managed orders, with reason-code selection. #3861
• getOrderDisplayStatus util aggregating item-level OMS statuses into a single order-level display status. #3900
• Bumped commerce-sdk-isomorphic to 5.4.0 (first stable release with the OMS Shopper Orders endpoints).

🤖 Shopper Agent

• Customer context for Shopper Agent — on conversation start, forwards the shopper's SLAS session to Core's Token Bridge via a same-origin PWA Kit proxy (access token in the body for non-HttpOnly mode; both tokens read server-side from cookies in HttpOnly mode), and resets the messaging session on guest ↔ registered transitions so the agent never inherits a stale identity. #3890
• Commerce Client as an optional shopper-agent provider — a new commerceAgent.provider switch (miaw default vs commerce-client); the Commerce Client UMD bundle is allowlisted to *.cimulate.ai with a configurable display mode. Existing MIAW storefronts are unaffected. #3925

📊 Distributed Tracing

• SSR render-path distributed tracing (production-gated) — a W3C ssr.render server span plus route-match/getProps/render-to-string and per-SCAPI scapi:<name> child spans parented on the incoming traceparent; exposes res.locals.traceparent for outbound propagation. Off → no-op. #3889
• Reports the matched route template as the low-cardinality http.route span attribute. #3917
• The retail template and create-app forward traceparent on CommerceApiProvider so SSR-time SCAPI/SLAS calls carry trace context. #3889

🧰 Maintenance Mode

• MaintenanceError (503) propagated through the SSR and client error pipelines; throwOnMaintenanceHeader: true by default so sfdc_maintenance responses throw automatically. #3827
• Maintenance page — renders a shared CDN-hosted page (default) or a built-in fallback; configured via app.pages.maintenancePage. #3827

🗄️ MRT Data Store

• Added the MrtDataStoreProvider context and useCustomSitePreferences / useCustomGlobalPreferences hooks (SSR-integrated; client reads window.__MRT_DATA_STORE__). #3811
• Bug Fix: aligned the client/server signatures of getCustomSitePreferences / getCustomGlobalPreferences (both async, same params) for React Query + SSR prepass patterns. #3811

🛡️ HttpOnly Session Cookies

• commerceAPI.cookieDomain support — when set, the SLAS proxy attaches Domain= to every Set-Cookie it emits and expires the host-scoped versions for clean migration (mirrors the client-side behavior). #3782
• Bug Fix — SSR token reconstruction (401 on data routes): the SLAS proxy now emits the host-scoped cookie deletion before the real Domain= cookie. On a cookieless SSR load the SDK reconstructs the token from Set-Cookie via last-write-wins per cookie name; the old order let the trailing empty deletion clobber the real token, causing 401s on data-bearing routes (e.g. a PLP deep link). The same fix applies to the refresh token (cc-nx/cc-nx-g).
• SCAPI Authorization pass-through & normalization: a valid Bearer <jwt> is now passed through to SCAPI unchanged (no longer overwritten by a stale/empty cookie), and incoming bearers are normalized to canonical Bearer. Closes cold-tab and hard-refresh 401s on PLP/PDP routes. #3859
• Cookie-metadata migration: SLAS metadata (customer_id, customer_type, enc_user_id, id_token, idp_refresh_token) moved from localStorage to proxy-set cookies; cc-nx-exists + refresh_token_expires_in replaced by a single cc-nx-expires (absolute expiry); added a useCookie hook. customer_id/customer_type now expire with the access token and re-issue on every token response. #3830 #3858
• Refresh-and-retry on SCAPI 401 instead of rendering a hard error page (invalid-but-unexpired token → refresh off the still-valid refresh token, retry once). Applies to both HttpOnly and localStorage modes. #3860
• Preserve SCAPI/SFRA error details — handleInvalidToken reads the error body from a clone so callers can still read details (e.g. an SFRA-hook dw.system.Status.ERROR on a 400).
• Fix stale sfdc_dwsid affinity header in CommerceApiProvider (a missing dwsid dependency could send a stale header, risking wrong/expired app-server routing on hybrid storefronts).

🖼️ Storefront Preview Updates

• Server-only __Host-pwakit_preview_ctx marker cookie set for trusted Runtime Admin iframe loads; adds Partitioned (CHIPS) support to the BFF cookie serializer; CSP now includes staging/preview Runtime Admin hosts. #3850
• SLAS proxy issues session cookies as SameSite=None; Partitioned for trusted preview parents; logout clears the marker. Resolves requestUsid timeout / access_token_cookie_missing 400s inside the preview iframe. #3851
• Follow-on fix: honors an x-pwakit-preview-parent header as an alternate trusted-preview signal for when the cacheable iframe document load is served from CDN cache and bypasses the marker writer.
• Extended IFRAME_HOST_ALLOW_LIST to include the soak and testing Runtime Admin environments. #3850
• Bugfix: Storefront Preview session loss with HttpOnly cookies enabled (the client now sends the trusted parent origin on the never-cached SLAS token request).

⚡ Storefront Performance & UX (retail template)

• SSR-open search refinements panels — replaced the ChakraUI v2 Accordion (which forces items closed in SSR) with a controlled disclosure, removing a post-hydration relayout that could become the PLP largest-contentful-paint element.
• Memoized the search refinements panel to stop needless re-renders. #3855
• PayPal/Venmo express checkout — resolves the buyer-approved address from the upstream PayPal Order and PATCHes the basket payment instrument on shipping-address change so the review screen reflects the new amount and shipping options. #3868
• Sync amount on the basket payment instrument before placing the order so the persisted PaymentTransaction matches orderTotal.
• Carrier tracking links now use rel="noopener noreferrer" so the order-page URL doesn't leak as the Referer.
• Bundle-size budget adjustments: vendor.js 395 → 398 kB, main.js 102 → 103 kB. #3834 #3868

🔒 Security

• Upgraded @salesforce/mrt-utilities ^0.1.6 → ^0.2.2, eliminating the fast-xml-parser dependency and resolving CVE-2026-26278 (Critical) plus CVE-2025-23333, CVE-2024-55565, CVE-2024-41818, CVE-2024-41810, CVE-2023-52426, and CVE-2023-34104 (now on AWS SDK 3.1049.0). #3911
• Upgraded all @opentelemetry/* packages ^1.15.1 → ^2.8.0 to resolve GHSA-8988-4f7v-96qf (unbounded memory allocation). #3911-

🏗️ Platform & Tooling

• MCP (0.5.0): added Node 24 support and dropped Node 16; retired the pwakit_create_component tool; added a fallback path for the custom API tool. #3652 #3437 #3458
• pwa-kit-dev: added TextEncoder/TextDecoder Jest polyfills for AWS SDK 3.x CBOR support (mrt-utilities 0.2.2+); fixed the babel-loader exclude regex on Windows. #3917 #3911 #3840
• create-app: made create-mobify-app-dev.js resilient under Node 24 + Docker (Verdaccio stdio and readiness-probe fixes), and kept the generated templates in sync with retail-react-app (Commerce Client CSP entries, traceparent forwarding, maintenance-page config). #3921 #3889 #3827