@salesforce/commerce-sdk-react 5.4.0 → 5.5.0-nightly-20260813082800

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## v5.5.0-nightly-20260813082800 (Aug 13, 2026)
+## v5.5.0-dev (Aug 13, 2026)
+## v3.21.0-nightly-20260813082800 (Aug 13, 2026)
+## v5.5.0-dev (Aug 12, 2026)
 ## v5.4.0 (Aug 12, 2026)
 - [Bugfix] Fix Trusted Agent (Order on Behalf) login hanging on a blank popup because `authorizeTrustedAgent` never sent an OAuth `state`. The storefront recognises the trusted agent callback by the presence of `state`: `request-processor.js` only keeps `code` on `/callback` (and `ssr.js` only serves that variant `no-store` and renders it) when `state` is set, and the callback page only hands `code`+`state` back to the opener when both are present. Without a `state` on the authorize request, SLAS redirected the popup to `/callback` with `code` only, the code was stripped as a standard-login redirect, an empty cacheable body was served, and the popup stayed blank with the login spinner never resolving. `authorizeTrustedAgent` now generates a CSRF `state` (a nonce distinct from the PKCE code verifier), sends it on the authorize request (SLAS echoes it back on the redirect), and returns it; `useTrustedAgent` compares the popup-echoed `state` against the one it minted before exchanging the code, and SLAS additionally binds `state`↔`code` on the token request.
 - [Bugfix] Fix Trusted Agent (Order on Behalf) login failing when the storefront sends a `Cross-Origin-Opener-Policy: same-origin` header. That header severs the authentication popup so the opener can no longer read the popup location and `popup.closed` wrongly reports `true`, which made the flow reject with "Popup closed without authenticating." before the agent finished. `useTrustedAgent` now receives the result out of band via `postMessage` from the same origin callback page with a `BroadcastChannel` fallback, and it no longer treats a severed `popup.closed` as user cancellation (a genuinely abandoned popup is still caught by the existing timeout). Exposes a `useTrustedAgentPopupCallback` hook for the same origin callback page to hand the OAuth result back to the opener. The hook owns the message contract and the delivery. After delivering the result the callback page also closes itself, since the opener's `popup.close()` is unreliable through the COOP-severed window reference. Additive to the public API. Adds `TRUSTED_AGENT_RUNBOOK.md` documenting the callback contract, the upgrade steps, and how to reproduce and verify the flow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/commerce-sdk-react",
-  "version": "5.4.0",
+  "version": "5.5.0-nightly-20260813082800",
   "description": "A library that provides react hooks for fetching data from Commerce Cloud",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/ecom-react-hooks#readme",
   "bugs": {
@@ -46,7 +46,7 @@
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@salesforce/pwa-kit-dev": "3.20.0",
+    "@salesforce/pwa-kit-dev": "3.21.0-nightly-20260813082800",
     "@tanstack/react-query": "^4.28.0",
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
@@ -61,7 +61,7 @@
     "@types/react-helmet": "~6.1.6",
     "@types/react-router-dom": "~5.3.3",
     "cross-env": "^5.2.1",
-    "internal-lib-build": "3.20.0",
+    "internal-lib-build": "3.21.0-nightly-20260813082800",
     "jsonwebtoken": "^9.0.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
@@ -98,5 +98,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "bb0a49284fed371ae582ced1268991a843f33be4"
+  "gitHead": "a8dab21ee9084c5caf5cdc0c7b10da6ddc5a4605"
 }