@salesforce/commerce-sdk-react 5.4.0-nightly-20260807082212 → 5.4.0-preview.0

package/CHANGELOG.md

@@ -1,7 +1,4 @@
-## v5.4.0-nightly-20260807082212 (Aug 07, 2026)
-## v5.4.0-dev (Aug 07, 2026)
-## v3.20.0-nightly-20260807082212 (Aug 07, 2026)
-## v5.4.0-dev (Jul 13, 2026)
+## v5.4.0-preview.0 (Aug 07, 2026)
 - [Bugfix] Fix Trusted Agent (Order on Behalf) login failing when the storefront sends a `Cross-Origin-Opener-Policy: same-origin` header. That header severs the authentication popup so the opener can no longer read the popup location and `popup.closed` wrongly reports `true`, which made the flow reject with "Popup closed without authenticating." before the agent finished. `useTrustedAgent` now receives the result out of band via `postMessage` from the same origin callback page with a `BroadcastChannel` fallback, and it no longer treats a severed `popup.closed` as user cancellation (a genuinely abandoned popup is still caught by the existing timeout). Exposes a `useTrustedAgentPopupCallback` hook for the same origin callback page to hand the OAuth result back to the opener. The hook owns the message contract and the delivery. After delivering the result the callback page also closes itself, since the opener's `popup.close()` is unreliable through the COOP-severed window reference. Additive to the public API. Adds `TRUSTED_AGENT_RUNBOOK.md` documenting the callback contract, the upgrade steps, and how to reproduce and verify the flow.
 - [Bugfix] Gracefully handle stale or malformed session tokens on load. A truncated `cc-at` cookie chunk or a value left by an older token format could be handed to `jwt-decode`, surfacing an `Invalid token specified: missing part #2` error to the storefront during `ready()`. The auth module now decodes such tokens defensively: an undecodable access token is discarded (and its cookie cleared) and treated as expired, an undecodable SFRA `cc-at` handoff token is cleared with a fallback to the local store, and a malformed `fetchedToken` is ignored — in every case the flow falls through to a refresh / guest login instead of throwing. Only affects non-HttpOnly / SSR / hybrid mode.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/commerce-sdk-react",
-  "version": "5.4.0-nightly-20260807082212",
+  "version": "5.4.0-preview.0",
   "description": "A library that provides react hooks for fetching data from Commerce Cloud",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/ecom-react-hooks#readme",
   "bugs": {
@@ -46,7 +46,7 @@
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@salesforce/pwa-kit-dev": "3.20.0-nightly-20260807082212",
+    "@salesforce/pwa-kit-dev": "3.20.0-preview.0",
     "@tanstack/react-query": "^4.28.0",
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
@@ -61,7 +61,7 @@
     "@types/react-helmet": "~6.1.6",
     "@types/react-router-dom": "~5.3.3",
     "cross-env": "^5.2.1",
-    "internal-lib-build": "3.20.0-nightly-20260807082212",
+    "internal-lib-build": "3.20.0-preview.0",
     "jsonwebtoken": "^9.0.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
@@ -98,5 +98,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "92d2bcd70c6c08840af8e05386d6974f713f5eff"
+  "gitHead": "63b3848e2c46b8e1ca540f8c80e7f9d96a4a7cb9"
 }