@salesforce/pwa-kit-runtime 3.19.0-preview.0 → 3.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/pwa-kit-runtime",
-  "version": "3.19.0-preview.0",
+  "version": "3.19.0",
   "description": "The PWAKit Runtime",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/pwa-kit-runtime#readme",
   "bugs": {
@@ -48,11 +48,11 @@
   },
   "devDependencies": {
     "@loadable/component": "^5.15.3",
-    "@salesforce/pwa-kit-dev": "3.19.0-preview.0",
+    "@salesforce/pwa-kit-dev": "3.19.0",
     "@serverless/event-mocks": "^1.1.1",
     "aws-lambda-mock-context": "^3.2.1",
     "fs-extra": "^11.1.1",
-    "internal-lib-build": "3.19.0-preview.0",
+    "internal-lib-build": "3.19.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
     "sinon": "^13.0.2",
@@ -66,5 +66,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "f93e393e81306cfc61186f9162324f7ff8ac7b3c"
+  "gitHead": "5192e11826187be0dbdacf4754c84ac18af64f67"
 }

package/ssr/server/build-remote-server.js

@@ -1197,6 +1197,11 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
             targetProtocol: 'https'
           });
 
+          // Internal preview-context signal consumed by the response
+          // interceptor (process-token-response); never forwarded to
+          // SLAS, regardless of the HttpOnly session-cookie flag.
+          proxyRequest.removeHeader(_constants.X_PREVIEW_PARENT);
+
           // Credential mode is taken from the allow-list entry
           // attached by the pre-proxy guard.
           const {
@@ -1369,6 +1374,11 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
             targetHost: options.slasHostName,
             targetProtocol: 'https'
           });
+
+          // Internal preview-context signal consumed by the response
+          // interceptor (process-token-response); never forwarded to
+          // SLAS, regardless of the HttpOnly session-cookie flag.
+          proxyRequest.removeHeader(_constants.X_PREVIEW_PARENT);
           if (httpOnlyCookiesEnabled) {
             handleHttpOnlyCookiesOnProxyReq(proxyRequest, incomingRequest);
           }

package/ssr/server/build-remote-server.test.js

@@ -888,6 +888,52 @@ describe('HttpOnly session cookies', () => {
       mockSlasServerInstance.close();
     }
   }));
+  test('strips x-pwakit-preview-parent from the upstream request even when HttpOnly is disabled', /*#__PURE__*/_asyncToGenerator(function* () {
+    // The header is an internal preview-context signal consumed by the
+    // response interceptor; it must never reach SLAS, regardless of the
+    // HttpOnly session-cookie flag (the private proxy is wired whenever
+    // useSLASPrivateClient is true).
+    delete process.env.MRT_ENABLE_HTTPONLY_SESSION_COOKIES;
+    let capturedPreviewParent = 'sentinel';
+    const mockSlasServer = mockExpress();
+    mockSlasServer.post('/shopper/auth/v1/organizations/f_ecom_test/oauth2/token', (req, res) => {
+      capturedPreviewParent = req.headers[_constants.X_PREVIEW_PARENT];
+      res.status(200).json({
+        access_token: 'mock-token',
+        expires_in: 1800,
+        refresh_token: 'mock-refresh-token'
+      });
+    });
+    const mockSlasServerInstance = mockSlasServer.listen(0);
+    const mockSlasPort = mockSlasServerInstance.address().port;
+    try {
+      const app = mockExpress();
+      const options = _buildRemoteServer.RemoteServerFactory._configure({
+        useSLASPrivateClient: true,
+        slasTarget: `http://localhost:${mockSlasPort}`,
+        mobify: {
+          app: {
+            commerceAPI: {
+              parameters: {
+                shortCode: 'test',
+                organizationId: 'f_ecom_test',
+                clientId: 'test-client-id',
+                siteId: 'testsite'
+              }
+            }
+          }
+        }
+      });
+      process.env.PWA_KIT_SLAS_CLIENT_SECRET = 'test-secret';
+      _buildRemoteServer.RemoteServerFactory._setupSlasPrivateClientProxy(app, options, false);
+      const response = yield request(app).post('/mobify/slas/private/shopper/auth/v1/organizations/f_ecom_test/oauth2/token').set(_constants.X_PREVIEW_PARENT, 'https://runtime.commercecloud.com');
+      expect(response.status).toBe(200);
+      // Upstream SLAS must not see the internal preview-context header.
+      expect(capturedPreviewParent).toBeUndefined();
+    } finally {
+      mockSlasServerInstance.close();
+    }
+  }));
   test('returns 500 when siteId is missing', /*#__PURE__*/_asyncToGenerator(function* () {
     process.env.MRT_ENABLE_HTTPONLY_SESSION_COOKIES = 'true';
     const mockSlasServer = mockExpress();

package/ssr/server/constants.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.X_SITE_ID = exports.X_ORIGINAL_CONTENT_TYPE = exports.X_MOBIFY_QUERYSTRING = exports.X_MOBIFY_FROM_CACHE = exports.X_GRANT_TYPE = exports.X_ENCODED_HEADERS = exports.STRICT_TRANSPORT_SECURITY = exports.STOREFRONT_PREVIEW_PARENT_ALLOW_LIST = exports.STOREFRONT_PREVIEW_CTX_COOKIE = exports.STATIC_ASSETS = exports.SLAS_TOKEN_RESPONSE_ENDPOINTS = exports.SLAS_LOGOUT_ENDPOINT = exports.SLAS_CUSTOM_PROXY_PATH = exports.SET_COOKIE = exports.PROXY_PATH_PREFIX = exports.NO_CACHE = exports.DWSID_COOKIE_NAME = exports.CONTENT_TYPE = exports.CONTENT_SECURITY_POLICY = exports.CONTENT_ENCODING = exports.CACHE_CONTROL = exports.BUILD = exports.APPLICATION_OCTET_STREAM = void 0;
+exports.X_SITE_ID = exports.X_PREVIEW_PARENT = exports.X_ORIGINAL_CONTENT_TYPE = exports.X_MOBIFY_QUERYSTRING = exports.X_MOBIFY_FROM_CACHE = exports.X_GRANT_TYPE = exports.X_ENCODED_HEADERS = exports.STRICT_TRANSPORT_SECURITY = exports.STOREFRONT_PREVIEW_PARENT_ALLOW_LIST = exports.STOREFRONT_PREVIEW_CTX_COOKIE = exports.STATIC_ASSETS = exports.SLAS_TOKEN_RESPONSE_ENDPOINTS = exports.SLAS_LOGOUT_ENDPOINT = exports.SLAS_CUSTOM_PROXY_PATH = exports.SET_COOKIE = exports.PROXY_PATH_PREFIX = exports.NO_CACHE = exports.DWSID_COOKIE_NAME = exports.CONTENT_TYPE = exports.CONTENT_SECURITY_POLICY = exports.CONTENT_ENCODING = exports.CACHE_CONTROL = exports.BUILD = exports.APPLICATION_OCTET_STREAM = void 0;
 /*
  * Copyright (c) 2021, salesforce.com, inc.
  * All rights reserved.
@@ -47,6 +47,12 @@ const SLAS_LOGOUT_ENDPOINT = exports.SLAS_LOGOUT_ENDPOINT = /\/oauth2\/logout/;
 const DWSID_COOKIE_NAME = exports.DWSID_COOKIE_NAME = 'dwsid';
 const X_SITE_ID = exports.X_SITE_ID = 'x-site-id';
 const X_GRANT_TYPE = exports.X_GRANT_TYPE = 'x-grant-type';
+// Client-sent header carrying the trusted Storefront Preview parent origin on
+// SLAS token requests. Read (and re-validated against
+// STOREFRONT_PREVIEW_PARENT_ALLOW_LIST) when choosing SameSite=None; Partitioned
+// for session cookies, as a CDN-cache-proof alternative to the
+// __Host-pwakit_preview_ctx marker cookie. Stripped before forwarding to SLAS/SCAPI.
+const X_PREVIEW_PARENT = exports.X_PREVIEW_PARENT = 'x-pwakit-preview-parent';
 
 // Server-only marker cookie set when the storefront is loaded inside a
 // trusted Storefront Preview iframe (parent origin attested by Sec-Fetch-*

package/ssr/server/httponly-cookie-config.js

@@ -20,10 +20,11 @@ var _constants = require("./constants");
  *
  * `attributes` covers the *static* per-cookie attributes only (`httpOnly`,
  * `secure`, `path`). `SameSite` and `Partitioned` are resolved per-request
- * by `setHttpOnlySessionCookies` based on the Storefront Preview marker
- * cookie — see `preview-context.js`. Top-level traffic gets `SameSite=Lax`;
- * traffic with a validated trusted-iframe marker gets
- * `SameSite=None; Partitioned`.
+ * by `setHttpOnlySessionCookies` based on the Storefront Preview signal —
+ * either the server-set marker cookie or the client-sent
+ * `x-pwakit-preview-parent` header (see `isTrustedPreviewRequest` in
+ * `preview-context.js`). Top-level traffic gets `SameSite=Lax`; traffic from a
+ * validated trusted iframe gets `SameSite=None; Partitioned`.
  */
 const SESSION_COOKIE_CONFIG = exports.SESSION_COOKIE_CONFIG = {
   accessToken: {

package/ssr/server/preview-context.js

@@ -4,7 +4,9 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.clearStorefrontPreviewMarker = clearStorefrontPreviewMarker;
+exports.isTrustedPreviewRequest = isTrustedPreviewRequest;
 exports.readStorefrontPreviewMarker = readStorefrontPreviewMarker;
+exports.readTrustedPreviewParentHeader = readTrustedPreviewParentHeader;
 exports.tryWriteStorefrontPreviewMarker = tryWriteStorefrontPreviewMarker;
 var _ssrProxying = require("../../utils/ssr-proxying");
 var _constants = require("./constants");
@@ -175,6 +177,44 @@ function readStorefrontPreviewMarker(req) {
   return value;
 }
 
+/**
+ * Returns the validated parent origin from the `x-pwakit-preview-parent`
+ * request header, or undefined when the header is absent or carries a value
+ * that is not on the trusted allow-list.
+ *
+ * The client (commerce-sdk-react) sends this header on SLAS token requests
+ * when it detects — via `window.location.ancestorOrigins` — that the
+ * storefront is running inside a trusted Storefront Preview iframe. Because
+ * the token request is a POST that is never served from the CDN cache, this
+ * header reliably reaches the origin even when the iframe *document* load
+ * (which sets the `__Host-pwakit_preview_ctx` marker cookie) is served from
+ * cache and never runs the marker-writer middleware.
+ *
+ * The value is re-validated here against the same allow-list as the marker
+ * cookie. A spoofed header is harmless: the worst case is that a caller
+ * receives its own session cookies with SameSite=None; Partitioned (which are
+ * partitioned by the caller's top-level site and grant no cross-site access),
+ * and only when the asserted origin is itself on the trusted allow-list.
+ */
+function readTrustedPreviewParentHeader(req) {
+  var _req$headers5;
+  const value = (_req$headers5 = req.headers) === null || _req$headers5 === void 0 ? void 0 : _req$headers5[_constants.X_PREVIEW_PARENT];
+  if (!value || !isAllowedParentOrigin(value)) return undefined;
+  return value;
+}
+
+/**
+ * Returns true when the request originates from a trusted Storefront Preview
+ * iframe — either via the server-set marker cookie (iframe document load that
+ * reached the origin) or via the client-sent `x-pwakit-preview-parent` header
+ * (CDN-cache-proof). Either signal is sufficient; both are re-validated
+ * against the trusted allow-list. Used to decide SameSite=None; Partitioned
+ * vs. SameSite=Lax for session cookies.
+ */
+function isTrustedPreviewRequest(req) {
+  return Boolean(readStorefrontPreviewMarker(req) || readTrustedPreviewParentHeader(req));
+}
+
 /**
  * Append a Set-Cookie header to expire the storefront-preview marker
  * cookie. Used on logout (called from `expireHttpOnlySessionCookies`) so

package/ssr/server/preview-context.test.js

@@ -189,6 +189,86 @@ describe('readStorefrontPreviewMarker', () => {
     expect((0, _previewContext.readStorefrontPreviewMarker)(req)).toBeUndefined();
   });
 });
+describe('readTrustedPreviewParentHeader', () => {
+  test('returns undefined when the header is absent', () => {
+    expect((0, _previewContext.readTrustedPreviewParentHeader)({
+      headers: {}
+    })).toBeUndefined();
+  });
+  test('returns the validated origin when the header value is on the allow-list', () => {
+    const req = {
+      headers: {
+        [_constants.X_PREVIEW_PARENT]: TRUSTED_PARENT
+      }
+    };
+    expect((0, _previewContext.readTrustedPreviewParentHeader)(req)).toBe(TRUSTED_PARENT);
+  });
+  test.each(_constants.STOREFRONT_PREVIEW_PARENT_ALLOW_LIST)('returns the origin for trusted parent %s', origin => {
+    const req = {
+      headers: {
+        [_constants.X_PREVIEW_PARENT]: origin
+      }
+    };
+    expect((0, _previewContext.readTrustedPreviewParentHeader)(req)).toBe(origin);
+  });
+  test('returns undefined when the header value is not on the allow-list', () => {
+    const req = {
+      headers: {
+        [_constants.X_PREVIEW_PARENT]: 'https://evil.example.com'
+      }
+    };
+    expect((0, _previewContext.readTrustedPreviewParentHeader)(req)).toBeUndefined();
+  });
+  test('returns undefined when the header value is empty', () => {
+    const req = {
+      headers: {
+        [_constants.X_PREVIEW_PARENT]: ''
+      }
+    };
+    expect((0, _previewContext.readTrustedPreviewParentHeader)(req)).toBeUndefined();
+  });
+});
+describe('isTrustedPreviewRequest', () => {
+  test('true when only the marker cookie is present', () => {
+    const req = {
+      headers: {
+        cookie: `${_constants.STOREFRONT_PREVIEW_CTX_COOKIE}=${TRUSTED_PARENT}`
+      }
+    };
+    expect((0, _previewContext.isTrustedPreviewRequest)(req)).toBe(true);
+  });
+  test('true when only the client header is present (CDN cache bypasses the marker)', () => {
+    const req = {
+      headers: {
+        [_constants.X_PREVIEW_PARENT]: TRUSTED_PARENT
+      }
+    };
+    expect((0, _previewContext.isTrustedPreviewRequest)(req)).toBe(true);
+  });
+  test('true when both signals are present', () => {
+    const req = {
+      headers: {
+        cookie: `${_constants.STOREFRONT_PREVIEW_CTX_COOKIE}=${TRUSTED_PARENT}`,
+        [_constants.X_PREVIEW_PARENT]: TRUSTED_PARENT
+      }
+    };
+    expect((0, _previewContext.isTrustedPreviewRequest)(req)).toBe(true);
+  });
+  test('false when neither signal is present', () => {
+    expect((0, _previewContext.isTrustedPreviewRequest)({
+      headers: {}
+    })).toBe(false);
+  });
+  test('false when both signals carry untrusted values', () => {
+    const req = {
+      headers: {
+        cookie: `${_constants.STOREFRONT_PREVIEW_CTX_COOKIE}=https://evil.example.com`,
+        [_constants.X_PREVIEW_PARENT]: 'https://evil.example.com'
+      }
+    };
+    expect((0, _previewContext.isTrustedPreviewRequest)(req)).toBe(false);
+  });
+});
 describe('STOREFRONT_PREVIEW_PARENT_ALLOW_LIST parity', () => {
   // The server-side allow-list (constants.js) MUST mirror IFRAME_HOST_ALLOW_LIST
   // in commerce-sdk-react/src/constant.ts. Drift would cause client and server

package/ssr/server/process-token-response.js

@@ -38,15 +38,17 @@ const PREVIEW_IFRAME_SITE_ATTRS = Object.freeze({
 
 /**
  * Resolves the SameSite/Partitioned attributes to apply to all session
- * cookies on this response. When the request carries a validated
- * Storefront-Preview marker (set under server-attested conditions on the
- * iframe document load), returns `{sameSite: 'none', partitioned: true}`
- * so cookies attach inside the cross-site iframe. Otherwise returns
+ * cookies on this response. When the request originates from a trusted
+ * Storefront Preview iframe — signalled either by the server-set marker
+ * cookie (iframe document load that reached the origin) or by the
+ * client-sent `x-pwakit-preview-parent` header (CDN-cache-proof, rides on
+ * the non-cacheable token POST) — returns `{sameSite: 'none', partitioned:
+ * true}` so cookies attach inside the cross-site iframe. Otherwise returns
  * `{sameSite: 'lax'}` (the existing top-level behavior).
  * @private
  */
 function getSiteAttrsForRequest(req) {
-  return (0, _previewContext.readStorefrontPreviewMarker)(req) ? PREVIEW_IFRAME_SITE_ATTRS : DEFAULT_SITE_ATTRS;
+  return (0, _previewContext.isTrustedPreviewRequest)(req) ? PREVIEW_IFRAME_SITE_ATTRS : DEFAULT_SITE_ATTRS;
 }
 
 // Refresh token cookie TTL defaults (seconds). Must stay in sync with commerce-sdk-react auth constants.
@@ -55,11 +57,27 @@ const DEFAULT_SLAS_REFRESH_TOKEN_REGISTERED_TTL = 90 * 24 * 60 * 60;
 
 /**
  * Returns a function that appends a Set-Cookie header to `res`. When
- * `cookieDomain` is configured, every write also emits a second expiring
- * Set-Cookie for the same name without a Domain attribute, expiring any
- * pre-existing host-scoped cookie. This mirrors
- * `CookieStorage.removeHostAndDomainCookie` in commerce-sdk-react and prevents
- * stale duplicates when a merchant first enables the cookieDomain config.
+ * `cookieDomain` is configured, every write first emits an expiring
+ * Set-Cookie for the same name WITHOUT a Domain attribute (clearing any
+ * pre-existing host-scoped cookie), THEN emits the real Domain-scoped cookie.
+ * This mirrors `CookieStorage.removeHostAndDomainCookie` in commerce-sdk-react
+ * and prevents stale duplicates when a merchant first enables the cookieDomain
+ * config.
+ *
+ * Order matters for SSR: on a cookieless SSR load, commerce-sdk-isomorphic
+ * reconstructs the guest-login TokenResponse from this response's Set-Cookie
+ * headers, parsing the array with last-write-wins per cookie name. Emitting the
+ * host-scoped deletion (empty value) BEFORE the real cookie ensures the real
+ * token value wins instead of being clobbered by the empty deletion —
+ * otherwise the SSR shopper token would be empty and data-bearing routes
+ * (e.g. a PLP) would 401 (regression of W-23388089). This rests on a cross-repo
+ * invariant: the parser is commerce-sdk-isomorphic's server-side TokenResponse
+ * reconstruction (helpers/slasHelper), which walks the Set-Cookie array keyed
+ * only by cookie NAME (Domain ignored) and assigns each token field with
+ * last-write-wins — notably both cc-nx and cc-nx-g map to refresh_token. If a
+ * future SDK version stops being last-write-wins (or skips empty values), this
+ * ordering must be revisited. In the browser the two writes target different
+ * cookie scopes (host vs Domain), so their relative order has no effect.
  *
  * `siteAttrs` (sameSite/partitioned) is decided per-request by
  * `getSiteAttrsForRequest` and applied uniformly to every cookie this
@@ -75,13 +93,9 @@ function makeAppendCookie(res, cookieDomain, siteAttrs) {
     expires,
     attributes
   }) => {
-    res.append(_constants.SET_COOKIE, (0, _ssrProxying.cookieAsString)(_objectSpread(_objectSpread(_objectSpread({
-      name,
-      value,
-      expires
-    }, attributes), siteAttrs), cookieDomain && {
-      domain: cookieDomain
-    })));
+    // Clear any pre-existing host-scoped cookie first. This must precede the
+    // real write so the SSR last-write-wins Set-Cookie parser recovers the
+    // real token value, not the empty deletion (see JSDoc above).
     if (cookieDomain) {
       res.append(_constants.SET_COOKIE, (0, _ssrProxying.cookieAsString)(_objectSpread(_objectSpread({
         name,
@@ -89,6 +103,13 @@ function makeAppendCookie(res, cookieDomain, siteAttrs) {
         expires: new Date(0)
       }, attributes), siteAttrs)));
     }
+    res.append(_constants.SET_COOKIE, (0, _ssrProxying.cookieAsString)(_objectSpread(_objectSpread(_objectSpread({
+      name,
+      value,
+      expires
+    }, attributes), siteAttrs), cookieDomain && {
+      domain: cookieDomain
+    })));
   };
 }
 
@@ -271,16 +292,21 @@ function setHttpOnlySessionCookies(responseBuffer, proxyRes, req, res, options)
     const refreshTTL = getRefreshTokenCookieTTL(parsed.refresh_token_expires_in, isGuest, commerceAPI);
     const refreshExpires = new Date(Date.now() + refreshTTL * 1000);
     const refreshConfig = isGuest ? refreshTokenGuest : refreshTokenRegistered;
-    appendCookie({
-      name: (0, _httponlyCookieConfig.getCookieName)(refreshConfig, site),
-      value: parsed.refresh_token,
-      expires: refreshExpires,
-      attributes: refreshConfig.attributes
-    });
 
     // Delete the opposite refresh token cookie to mirror client-side behavior:
     // Login (guest → registered): delete guest cookie cc-nx-g
     // Logout (registered → guest): delete registered cookie cc-nx
+    //
+    // This deletion MUST be emitted BEFORE the real refresh-token write
+    // below. Both cc-nx and cc-nx-g map to `refresh_token` in
+    // commerce-sdk-isomorphic's SSR TokenResponse reconstruction, which
+    // parses the Set-Cookie array with last-write-wins per token field
+    // (ignoring the Domain attribute). If the empty opposite-cookie deletion
+    // were emitted last it would clobber the reconstructed refresh_token to
+    // empty — the same failure mode fixed for the access token in
+    // makeAppendCookie. The browser is unaffected either way (cc-nx and
+    // cc-nx-g are distinct cookie names, so their relative order is
+    // irrelevant there).
     const staleRefreshConfig = isGuest ? refreshTokenRegistered : refreshTokenGuest;
     appendCookie({
       name: (0, _httponlyCookieConfig.getCookieName)(staleRefreshConfig, site),
@@ -288,6 +314,12 @@ function setHttpOnlySessionCookies(responseBuffer, proxyRes, req, res, options)
       expires: new Date(0),
       attributes: staleRefreshConfig.attributes
     });
+    appendCookie({
+      name: (0, _httponlyCookieConfig.getCookieName)(refreshConfig, site),
+      value: parsed.refresh_token,
+      expires: refreshExpires,
+      attributes: refreshConfig.attributes
+    });
 
     // Hybrid SFRA + PWA: mirror session-scoped SLAS metadata as
     // siteId-suffixed cookies so SFRA can read the same session state. These

package/ssr/server/process-token-response.test.js

@@ -65,6 +65,27 @@ function makeOptionsWithCookieDomain(cookieDomain) {
 function findCookies(cookies, name) {
   return cookies.filter(c => c.startsWith(`${name}=`)).map(parseCookie);
 }
+
+// Mirrors commerce-sdk-isomorphic's SSR TokenResponse reconstruction: it walks
+// the response's Set-Cookie array in emission order and assigns per token field
+// with last-write-wins, keyed only by cookie NAME (the Domain attribute is
+// ignored). The SDK reconstructs exactly three fields — cc-at → access_token,
+// cc-nx/cc-nx-g → refresh_token (BOTH names), idp_access_token → idp_access_token
+// — so those are the ones modelled here. This is what a cookieless SSR guest
+// login uses to recover its tokens, so the raw emission order of these
+// Set-Cookie headers is load-bearing — see the ordering notes in makeAppendCookie
+// and the refresh-token block of process-token-response.js.
+function reconstructSsrTokens(cookies, site = 'testsite') {
+  const out = {};
+  for (const raw of cookies) {
+    const {
+      name,
+      value
+    } = parseCookie(raw);
+    if (name === `cc-at_${site}`) out.access_token = value;else if (name === `cc-nx_${site}` || name === `cc-nx-g_${site}`) out.refresh_token = value;else if (name === `idp_access_token_${site}`) out.idp_access_token = value;
+  }
+  return out;
+}
 describe('getRefreshTokenCookieTTL', () => {
   const GUEST_DEFAULT = 30 * 24 * 60 * 60;
   const REGISTERED_DEFAULT = 90 * 24 * 60 * 60;
@@ -577,6 +598,107 @@ describe('cookieDomain support', () => {
     expect(atActive.domain).toBe('.example.com');
     expect(atActive.httpOnly).toBe(true);
   });
+  test('emits the host-scoped deletion BEFORE the real Domain-scoped write (raw emission order)', () => {
+    // The existing cleanup test above sorts the two writes by Domain, so it
+    // would still pass if the two res.append calls in makeAppendCookie were
+    // flipped back — reintroducing the SSR-reconstruction 401. Assert the
+    // raw emission order directly so that regression is caught.
+    const res = makeRes();
+    const accessToken = makeJWT({
+      iat: 1000,
+      exp: 2800,
+      isb: 'uido:ecom::upn:Guest'
+    });
+    const buf = makeResponseBuffer({
+      access_token: accessToken,
+      refresh_token: 'refresh-value'
+    });
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(buf, {}, makeReq(), res, makeOptionsWithCookieDomain('.example.com'));
+
+    // For a given cookie name, the empty host-scoped deletion must be emitted
+    // before the real Domain-scoped value so last-write-wins recovers the value.
+    const assertDeletionFirst = (name, realValue) => {
+      const idxOf = predicate => res.cookies.findIndex(c => c.startsWith(`${name}=`) && predicate(parseCookie(c)));
+      const deletionIdx = idxOf(c => c.value === '' && c.domain === undefined);
+      const realIdx = idxOf(c => c.value === realValue && c.domain === '.example.com');
+      expect(deletionIdx).toBeGreaterThanOrEqual(0);
+      expect(realIdx).toBeGreaterThanOrEqual(0);
+      expect(deletionIdx).toBeLessThan(realIdx);
+    };
+    assertDeletionFirst('cc-at_testsite', accessToken);
+    assertDeletionFirst('cc-nx-g_testsite', 'refresh-value');
+  });
+  test('SSR last-write-wins reconstruction recovers the real access, refresh AND idp tokens', () => {
+    // Guards the end-to-end invariant, including the cross-name refresh case
+    // that the per-name ordering test above cannot catch: the empty
+    // opposite-refresh deletion (cc-nx) is emitted as a separate appendCookie
+    // AFTER the real cc-nx-g in the pre-fix code, and both names map to
+    // refresh_token — so the deletion would clobber the reconstructed token.
+    // idp_access_token is also SDK-reconstructed and body-stripped, so it
+    // relies on the same makeAppendCookie deletion-before-real ordering; pin
+    // it here too.
+    const accessToken = makeJWT({
+      iat: 1000,
+      exp: 2800,
+      isb: 'uido:ecom::upn:Guest'
+    });
+    const body = {
+      access_token: accessToken,
+      refresh_token: 'refresh-value',
+      idp_access_token: 'idp-at-value'
+    };
+    const expected = {
+      access_token: accessToken,
+      refresh_token: 'refresh-value',
+      idp_access_token: 'idp-at-value'
+    };
+
+    // With cookieDomain configured (the reported 401 scenario).
+    const withDomain = makeRes();
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(makeResponseBuffer(body), {}, makeReq(), withDomain, makeOptionsWithCookieDomain('.example.com'));
+    expect(reconstructSsrTokens(withDomain.cookies)).toEqual(expected);
+
+    // And without cookieDomain: the opposite-refresh deletion is still emitted
+    // last in the pre-fix code, so refresh_token must survive here too.
+    const noDomain = makeRes();
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(makeResponseBuffer(body), {}, makeReq(), noDomain, {});
+    expect(reconstructSsrTokens(noDomain.cookies)).toEqual(expected);
+  });
+  test('SSR last-write-wins reconstruction recovers tokens for a REGISTERED login (mirror case)', () => {
+    // The guest test above exercises cc-nx-g as the real cookie and cc-nx as
+    // the empty opposite-deletion. The registered branch is the mirror: cc-nx
+    // is the real refresh cookie and cc-nx-g is the empty deletion, so the
+    // deletion-before-real ordering must hold for it too. A registered JWT
+    // uses a non-Guest `isb`.
+    const registeredToken = makeJWT({
+      iat: 1000,
+      exp: 2800,
+      isb: 'uido:ecom::upn:user@example.com::uidn:Jane'
+    });
+    const res = makeRes();
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(makeResponseBuffer({
+      access_token: registeredToken,
+      refresh_token: 'refresh-value'
+    }), {}, makeReq(), res, makeOptionsWithCookieDomain('.example.com'));
+    expect(reconstructSsrTokens(res.cookies)).toEqual({
+      access_token: registeredToken,
+      refresh_token: 'refresh-value'
+    });
+  });
+  test('logout expires both refresh cookies so SSR cannot reconstruct a token', () => {
+    // After logout SSR must not be able to rebuild a refresh token from the
+    // response. Order doesn't matter here (all writes are empty) but presence
+    // does: cc-nx and cc-nx-g both map to refresh_token, so both must be
+    // emitted empty.
+    const res = makeRes();
+    (0, _processTokenResponse.expireHttpOnlySessionCookies)(makeReq(), res, makeOptionsWithCookieDomain('.example.com'));
+    for (const name of ['cc-nx_testsite', 'cc-nx-g_testsite']) {
+      const matches = findCookies(res.cookies, name);
+      expect(matches.length).toBeGreaterThan(0);
+      expect(matches.every(c => c.value === '')).toBe(true);
+    }
+    expect(reconstructSsrTokens(res.cookies).refresh_token).toBe('');
+  });
   test('setHttpOnlySessionCookies warns and ignores invalid cookieDomain', () => {
     const res = makeRes();
     const accessToken = makeJWT({
@@ -645,6 +767,17 @@ describe('trusted Storefront Preview iframe', () => {
       }
     };
   }
+
+  // The client-sent header path — used when the iframe document load is
+  // served from the CDN cache and never sets the marker cookie.
+  function makeReqWithHeader(value, siteId = 'testsite') {
+    return {
+      headers: {
+        [_constants.X_SITE_ID]: siteId,
+        [_constants.X_PREVIEW_PARENT]: value
+      }
+    };
+  }
   function makeFullSlasResponse() {
     const accessToken = makeJWT({
       iat: 1000,
@@ -717,6 +850,30 @@ describe('trusted Storefront Preview iframe', () => {
       expect(cookieStr).not.toMatch(/Partitioned/i);
     }
   });
+  test('every session cookie carries SameSite=none; Partitioned when only the client header is present (CDN-cached document load, no marker cookie)', () => {
+    const res = makeRes();
+    const {
+      buf
+    } = makeFullSlasResponse();
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(buf, {}, makeReqWithHeader(TRUSTED_PARENT), res, {});
+    expect(res.cookies.length).toBeGreaterThan(0);
+    for (const cookieStr of res.cookies) {
+      expect(cookieStr).toMatch(/SameSite=none/i);
+      expect(cookieStr).toMatch(/Partitioned/i);
+      expect(cookieStr).not.toMatch(/SameSite=lax/i);
+    }
+  });
+  test('falls back to SameSite=Lax when the client header value is not on the allow-list', () => {
+    const res = makeRes();
+    const {
+      buf
+    } = makeFullSlasResponse();
+    (0, _processTokenResponse.setHttpOnlySessionCookies)(buf, {}, makeReqWithHeader('https://attacker.example.com'), res, {});
+    for (const cookieStr of res.cookies) {
+      expect(cookieStr).toMatch(/SameSite=lax/i);
+      expect(cookieStr).not.toMatch(/Partitioned/i);
+    }
+  });
   test('expireHttpOnlySessionCookies under the iframe path emits SameSite=none; Partitioned on every deletion (so partitioned cookies actually clear)', () => {
     const res = makeRes();
     (0, _processTokenResponse.expireHttpOnlySessionCookies)(makeReqWithMarker(TRUSTED_PARENT), res, {});