@salesforce/retail-react-app 10.4.0-nightly-20261110080254 → 11.0.0

package/CHANGELOG.md

@@ -1,29 +1,34 @@
-## v10.4.0-dev (Oct 20, 2026)
-- [Bugfix] Keep PDPs working when embedded agent configuration is absent. Preserve failed shopper-agent handoff questions with retry feedback or MIAW manual-send guidance, avoid send-method fallthrough after delivery errors, and remove unused handoff scaffolding. [#4101](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4101)
-- [Enhancement] Add boolean `preWarm` configuration for the inline agent widget (enabled by default). The widget starts its SCRT2 handshake when at least half visible; set `preWarm: false` for a cold connection on the first question. Shopper-agent mode uses the handoff shim without starting an embedded session. Includes inline-agent-widget PRs #26, #27, and #28. [#4101](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4101)
+## v11.0.0 (Nov 10, 2026)
 - [Feature] Export `getDynamicRoutes(config)` from `app/routes` so projects that extend this template can include the config-gated routes (reset password and passwordless login landing pages, social login redirect, guest order lookup, Shopper Agent express payment).
 - [Security] Require `login_id` and `channel_id` on passwordless OTP token exchange (`loginPasswordless`) from the login page, auth modal, and one-click checkout contact/registration flows, so SLAS can reject mismatched identifiers. Map SLAS 400 missing/mismatched-identifier errors and passwordless rate limits (429) to existing OTP/login UX, and map password/action rate limits (429) to the too-many-password-reset-attempts UX. Depends on `@salesforce/commerce-sdk-react@6.0.0` (breaking major; pairs with `commerce-sdk-isomorphic@5.8.0`). [#4075](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4075)
 - [Security] Passwordless magic links no longer carry the shopper email. When the shopper opens the link in the browser that requested it, the login landing page sends the email remembered at request time (stored in `localStorage` for 15 minutes) as `login_id`; in any other browser or device it keeps the token and asks the shopper to confirm their email to finish signing in. A `login_id` query parameter (for example in a merchant-configured `email` mode link) is still accepted. Token exchange failures on the landing page are now shown instead of leaving the shopper on the sign-in page with no feedback. **Upgrade note:** if your project overrides the login page, auth modal, or one-click checkout contact/registration components, call `rememberPasswordlessLoginId(email)` after each successful `authorizePasswordless` call so same-browser magic links sign in without the extra step. Both remembered emails are cleared on logout; if you add your own logout action, call `clearRememberedAuthEmails()` there too. [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Feature] The reset password landing page prefills the email when the shopper opens the link in the browser that requested it (stored in `localStorage` for 15 minutes, separately from the passwordless email, and cleared after a successful reset). In any other browser the shopper enters it as before. The reset link still carries only the token. [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Enhancement] Update guest order lookup copy per the UI text review: the request page now reads "Order Lookup" with revised intro text, title-case field labels, and a "Find Order" button; the verify page uses "Enter the verification code that we sent to {email}.". Remove the placeholder "Order Status" footer link, which pointed to the home page. [#4090](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4090)
 - [Bugfix] Keep Commerce Client shopper-agent product links on the PWA Kit storefront. The agent backend sends product links as SFRA URLs on the backend origin (e.g. `/en_US/<slug>-<id>.html`), which the widget's `onNavigate` never sees, so clicking a product card left for the SFRA PDP. The storefront now reads the product id from those links in the widget's product slots (cards, product detail title, comparison columns), rewrites their `href` to the PWA product page, and routes plain clicks through the router. Links in agent message text are left alone. When the product id is not certain from the URL (the last path segment contains `-`, so it may be a name slug and id, or an id that contains `-`), it is resolved through Shopper SEO `getUrlMapping`; if that finds no product the link keeps its backend URL rather than pointing at a storefront 404. [#4076](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4076)
+- [Enhancement] Increase the `main.js` bundle-size budget from 109 kB to 111 kB for the Shopper Agent express-payment iframe framework, and the `vendor.js` budget from 403 kB to 412 kB for the embedded Page Designer content blocks. [#4063](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4063), [#4042](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4042)
 - [Feature] Add a neutral Shopper Agent express-payment iframe framework with cart and product routes, a merchant provider lifecycle contract, validated iframe-to-host events, and automatic iframe sizing. [#4063](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4063)
-- [Changed] Rename `pwakit-notify` notification types to flow-based names: `passwordless-magic-link` → `passwordless-login`, `otp` → `password-registration`. Adds new `passwordless-registration` type for new-user magic-link delivery — intentionally skips the anti-enumeration account-existence check (correct for the new-user registration flow). The cartridge changes are aligned 1-to-1 with sf-next PR #2946. [Security] Cross-validate `email_id` from the SLAS callback JWT against the request body in the passwordless-login callback, preventing email relay via an arbitrary-recipient registration email when `register=true`.
+- [Changed] Rename `pwakit-notify` notification types to flow-based names: `passwordless-magic-link` → `passwordless-login`, `otp` → `password-registration`. Adds new `passwordless-registration` type for new-user magic-link delivery — intentionally skips the anti-enumeration account-existence check (correct for the new-user registration flow).
+- [Security] Cross-validate `email_id` from the SLAS callback JWT against the request body in the passwordless-login callback, preventing email relay via an arbitrary-recipient registration email when `register=true`.
 - [Security] Cross-validate `email_id` and `token` claims in the SLAS callback JWT against the request body in the registration-verification callback (`/registration-verification-callback`), preventing email-relay attacks where a caller with a valid tenant-signed guest token could trigger OTP delivery to an arbitrary address. [#4067](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4067)
 - [Bugfix] Gate the GLO magic-link auto-submit on `emailFromContext` (email present in router state) rather than the derived `email` variable, so arriving directly via magic link no longer attempts an auto-submit before the user enters their email address. [#4067](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4067)
 - [Enhancement] Update inline agent widget UMD bundle: add follow-up suggestion pills from agent responses, and send `commerce_agent_context` as a TextValue JSON string. Bump the embedded agent `capabilitiesVersion` to `66` (new `DEFAULT_EMBEDDED_AGENT_CAPABILITIES_VERSION` constant, separate from the Commerce Client's `65`) for context-variable support. Built from [inline-agent-widget#17](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/17) and [inline-agent-widget#18](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/18). [#4061](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4061)
-- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 to avoid an npm 10 dependency resolver crash during fresh installs while the Vitest browser packages require 4.1.11.
-- [Bugfix] Fix `useScript` remount when the script tag is already in the DOM. ShopperAgent (and other consumers) stayed at `loaded: false` after a remount because the existing tag never fired `load` again, so the Commerce Client widget did not re-inject. The hook now stamps `data-script-status` on load/error and only reports `loaded: true` when that status is `ready`; an in-flight tag stays unloaded until it finishes. [#4062](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4062) (W-24380725)
-- [Bugfix] Route Commerce Client widget product/checkout/markdown clicks through the storefront `useNavigation` router via the widget's `onNavigate` callback, so same-tab same-origin links stay in the SPA instead of triggering a full page load. Requires Commerce Client widget `1.48.0+`. `cc_openLinksInNewTab: "true"` is unchanged and still opens a new tab. Also fixes `buildUrl` (`createUrlTemplate`) when site/locale are configured as `query_param`: paths that already have a query string or hash now get site/locale merged into the existing query instead of a second `?` appended (which previously corrupted params like `q`/`pid` and swallowed the hash).
+- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 to avoid an npm 10 dependency resolver crash during fresh installs while the Vitest browser packages require 4.1.11. [#4064](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4064)
+- [Bugfix] Fix `useScript` remount when the script tag is already in the DOM. ShopperAgent (and other consumers) stayed at `loaded: false` after a remount because the existing tag never fired `load` again, so the Commerce Client widget did not re-inject. The hook now stamps `data-script-status` on load/error and only reports `loaded: true` when that status is `ready`; an in-flight tag stays unloaded until it finishes. [#4062](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4062)
+- [Bugfix] Route Commerce Client widget product/checkout/markdown clicks through the storefront `useNavigation` router via the widget's `onNavigate` callback, so same-tab same-origin links stay in the SPA instead of triggering a full page load. Requires Commerce Client widget `1.48.0+`. `cc_openLinksInNewTab: "true"` is unchanged and still opens a new tab. Also fixes `buildUrl` (`createUrlTemplate`) when site/locale are configured as `query_param`: paths that already have a query string or hash now get site/locale merged into the existing query instead of a second `?` appended (which previously corrupted params like `q`/`pid` and swallowed the hash). [#4035](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4035)
 - [Enhancement] Update inline agent widget UMD bundle: replace the text-prefix product-context hack with the proper SCRT2 v2 session-context API. Product context is now sent as a `commerce_agent_context` StructuredValue in the SessionContextSet envelope, leaving the shopper's message text unchanged. Default `capabilitiesVersion` bumped to `"65"`. Built from [inline-agent-widget#3](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/3). [#4054](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4054)
 - [Feature] Add `app_pwakit_base` B2C cartridge for transactional email delivery via ISML templates and `dw/net/Mail`. GLO access-code emails use the `sfcc.app.order.sendOrderAccessCode` hook; passwordless login, OTP verification, and password reset use the `pwakit-notify` Custom REST API (`POST .../organizations/{orgId}/notify?siteId={siteId}`, guarded by the `c_pwakit_notify` SLAS scope). Deploy with `npm run deploy:cartridge` from `packages/template-retail-react-app` (uses `b2c-cli` with `--reload` to upload the cartridge and re-register the SCAPI endpoint in one step), then import `OrganizationPreferences.xml` to enable the `pwakitNotifyEnabled` and `pwakitStorefrontHost` site preferences. **Required: create a dedicated private SLAS client** (`notifyClientId`) scoped only to `c_pwakit_notify`, set `PWA_KIT_NOTIFY_SLAS_CLIENT_SECRET` to its secret, and add `notifyClientId` to `commerceAPI.parameters` in your config. **Do not add `c_pwakit_notify` to the shopper/public client** — doing so makes browser-minted guest tokens capable of calling the notification API directly, reopening the email-relay risk this design is intended to close. See `cartridges/app_pwakit_base/README.md` for full setup steps. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - [Breaking change] `config/default.js` now sets `mode: 'callback'` for both `passwordless` and `resetPassword` flows (previously `'email'`). This routes password-reset confirmation through the SSR `/reset-password-callback` route and the new `pwakit-notify` cartridge. **Projects that adopt this config without deploying the cartridge will have broken password resets** — there is no `resetPassword.enabled` guard (unlike `passwordless.enabled`). Either deploy the cartridge before adopting the config change, or explicitly override `resetPassword.mode` back to `'email'`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] Marketing Cloud email delivery is removed from `app/ssr.js`. The `emailLink` function and the `MARKETING_CLOUD_CLIENT_ID`, `MARKETING_CLOUD_CLIENT_SECRET`, `MARKETING_CLOUD_SUBDOMAIN`, `MARKETING_CLOUD_PASSWORDLESS_LOGIN_TEMPLATE` and `MARKETING_CLOUD_RESET_PASSWORD_TEMPLATE` environment variables are no longer read. Passwordless login, password reset and registration emails are now sent through the `pwakit-notify` endpoint of the `app_pwakit_base` cartridge. Projects that send these emails through Marketing Cloud must deploy the cartridge and configure `notifyClientId` and `PWA_KIT_NOTIFY_SLAS_CLIENT_SECRET`, or keep their own copy of the previous `emailLink` implementation in an overridden `ssr.js`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] `config/default.js` now sets `passwordless.enabled` to `true` (previously `false`); projects generated with `create-app` use a bootstrap config that keeps it `false`. Combined with `mode: 'callback'`, projects that inherit this config need the `app_pwakit_base` cartridge deployed or must set `passwordless.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] `config/default.js` now sets `guestOrderLookup.enabled` to `true` (previously `false`); projects generated with `create-app` use a bootstrap config that does not enable it. This enables the `/order-lookup` routes and the order access code email, which is sent by the cartridge's `sendOrderAccessCode` hook. Deploy the `app_pwakit_base` cartridge or set `guestOrderLookup.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] Projects that override passwordless or reset password code must update their calls: `loginPasswordless` now needs `login_id` (the email sent to `authorizePasswordless`) and `channel_id` (the site id), and `resetPassword` now needs `user_id` (the email the reset was requested for). See the `@salesforce/commerce-sdk-react` 6.0.0 changelog. [#4075](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4075), [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Bugfix] Fix GLO `/api/guestOrderLookup/verify` and related server endpoints returning 401 when `enablePWAKitPrivateClient` is enabled. The `cc-nx-g_` cookie stores the SLAS refresh token, not the access token — the access token is never stored in any cookie. All GLO server endpoints now read the SLAS JWT from the `Authorization` header sent by the client (via `useAccessToken().getTokenWhenReady()`), which works correctly in both public and private client modes. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
-- [Enhancement] End the Commerce Client shopper-agent conversation when a registered shopper logs out, instead of re-linking it to the guest. Uses the widget's `eventHandlers.session.endConversation()` (`cc_cdnVersion` >= `1.39.0`), falls back to `resetConversation()` on `1.36.0`–`1.38.x`, and to re-linking before `1.36.0`. Also keeps the widget mounted through the login/logout basket reload so the bundle is not injected twice. [#4051](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4051) (W-24207318)
+- [Enhancement] End the Commerce Client shopper-agent conversation when a registered shopper logs out, instead of re-linking it to the guest. Uses the widget's `eventHandlers.session.endConversation()` (`cc_cdnVersion` >= `1.39.0`), falls back to `resetConversation()` on `1.36.0`–`1.38.x`, and to re-linking before `1.36.0`. Also keeps the widget mounted through the login/logout basket reload so the bundle is not injected twice. [#4051](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4051)
+- [Enhancement] Commerce Client shopper identity linking now retrieves the auth link key via the widget's `window.CimulateMessaging.getAuthLinkKey()` when the bundle exposes it, instead of calling SCRT2's `/iamessage/api/v2/authorization/authlink` endpoint directly with the Commerce Client JWT. Older bundles without the function fall back to the direct SCRT2 call (feature-detected, not version-checked). A `getAuthLinkKey()` rejection is surfaced as a linking failure rather than retried via the fallback, since both paths hit the same endpoint. [#4050](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4050)
+- [Feature] Add embedded Page Designer content-block support to the retail template, including an Announcement Banner content component, a preview-only Header layout, and a chrome-free `/preview/component` route for standalone component previews. [#4042](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4042)
+- [Feature] Add opener question pills to the inline agent widget on the PDP. The Product Detail page parses SCAPI `c_pdpQuestions` (a JSON-encoded array of strings published by Commerce Content Studio) and forwards it to the widget via the new `pdp-questions` attribute. The widget renders up to 5 tappable pills above the input; tapping a pill sends it through the same message path as typed input, and pills auto-hide once the shopper engages. On SPA navigation between PDPs the pills re-appear for the new product's list. Malformed or absent `c_pdpQuestions` renders no pills.
 
 ## v10.3.0 (Oct 08, 2026)
-- [Enhancement] Commerce Client shopper identity linking now retrieves the auth link key via the widget's `window.CimulateMessaging.getAuthLinkKey()` when the bundle exposes it, instead of calling SCRT2's `/iamessage/api/v2/authorization/authlink` endpoint directly with the Commerce Client JWT. Older bundles without the function fall back to the direct SCRT2 call (feature-detected, not version-checked). A `getAuthLinkKey()` rejection is surfaced as a linking failure rather than retried via the fallback, since both paths hit the same endpoint. [#4050](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4050) (W-24076703)
-- [Feature] Add embedded Page Designer content-block support to the retail template, including an Announcement Banner content component, a preview-only Header layout, and a chrome-free `/preview/component` route for standalone component previews. [#4042](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4042)
 - [Enhancement] Rename `INLINE_AGENT_WIDGET_COMMERCE_SETTINGS` environment variable to `EMBEDDED_AGENT_COMMERCE_SETTINGS` and config key `inlineAgentWidget` to `embeddedAgent` to align with updated product terminology. [#4041](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4041)
 - [Feature] Add a configurable `cc_enableImageUpload` toggle for the Commerce Client (Embedded Messaging) shopper-agent widget, defaulting to `'false'` and forwarded to the bundle as `messagingConfig.enableImageUpload`. Set it to `'true'` via `COMMERCE_AGENT_SETTINGS` to let shoppers upload images in the chat; requires a Commerce Client bundle that supports image upload (`cc_cdnVersion` >= `1.44.0`) plus the backend file-upload prerequisites. Also adds `blob:` and `data:` to the `img-src` CSP directive in `app/ssr.js` so the widget can render the pre-send preview (a `blob:` URL) and the sent-image thumbnail (a `data:` URL); the widget renders images locally only, so no image host is added. [#4030](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4030)
 - [Feature] Add the `dw_attribution` first-touch marketing-attribution cookie (W-23493129). The app writes a sanitized, allowlist-only campaign cookie client-side on load so Salesforce CIP can attribute placed orders back to the campaign that drove a headless-storefront visit. Writing in the browser (not on SSR) means it also fires on a CDN document-cache hit — where the SSR handler never runs — and lets the app clear the cookie the instant a shopper opts out; campaign landing pages stay fully cacheable. The Secure + `SameSite=Lax` cookie has a 30-minute write-once TTL and stores percent-encoded `key=value` pairs (`utm_source`/`utm_medium`/`utm_campaign`/`utm_term`/`utm_content`, `gclid`, `fbclid`, `msclkid`, and a sanitized external `ref` — origin, path, and its own allowlisted params only); no free-text query params are captured. It is write-once (first touch wins) and honors Do Not Track (`dw_dnt=1`): while opted out it captures nothing and expires any existing cookie.
@@ -38,8 +43,7 @@
 - [Enhancement] Update inline agent widget UMD bundle: auto-restart session on expiry instead of showing an error. The widget silently resets to idle and the next message starts a fresh session transparently. [#4015](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4015)
 - [Enhancement] Update inline agent widget UMD bundle: show user question bubble, add 4,000-character message limit, improve error handling with generic user-facing messages, fix 403 stale-conversation reset, and hide restored session Q&A on page reload. [#4032](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4032)
 - [Enhancement] Update inline agent widget UMD bundle: suppress agent welcome message on conversation start, and clear stale question/answer when navigating between product pages via SPA routing.
-- [Feature] Add opener question pills to the inline agent widget on the PDP (@W-24333476). The Product Detail page parses SCAPI `c_pdpQuestions` (a JSON-encoded array of strings published by Commerce Content Studio) and forwards it to the widget via the new `pdp-questions` attribute. The widget renders up to 5 tappable pills above the input; tapping a pill sends it through the same message path as typed input, and pills auto-hide once the shopper engages. On SPA navigation between PDPs the pills re-appear for the new product's list. Malformed or absent `c_pdpQuestions` renders no pills.
-- [Feature] Add Guest Order Lookup (GLO): unauthenticated shoppers can look up an order by order number and email, verify ownership via a time-limited 6-digit access code (valid for 15 minutes, reusable within the window), and view a filtered order detail page (shipment tracking, items, payment summary, shipping address). Server-side endpoints (`/api/guestOrderLookup/{verify,order,oms-meta,cancel,return}`) receive the SLAS access token via the `Authorization` header (sent by the client using `useAccessToken().getTokenWhenReady()`), call SCAPI with the shopper's bearer token, and filter the response to safe fields. The verify endpoint writes a `cc-goa_` HttpOnly cookie binding the order number to the verified access code; all subsequent order endpoints validate this cookie before proxying. [#3982](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3982)
+- [Feature] Add Guest Order Lookup (GLO): unauthenticated shoppers can look up an order by order number and email, verify ownership via a time-limited 6-digit access code (valid for 15 minutes, reusable within the window), and view a filtered order detail page (shipment tracking, items, payment summary, shipping address). Server-side endpoints (`/api/guestOrderLookup/{verify,order,oms-meta,cancel,return}`) read the SLAS access token from the HttpOnly `cc-at_*` cookie, call SCAPI with the shopper's bearer token, and filter the response to safe fields. The verify endpoint writes a `cc-goa_` HttpOnly cookie binding the order number to the verified access code; all subsequent order endpoints validate this cookie before proxying. [#3982](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3982)
 - [Feature] Forward two backend-gating signals on the Commerce Client shopper-agent widget's `routingAttributes`: `clientVersion` (sourced from `cc_cdnVersion`, so the runtime can gate rich components on the client's capability version; omitted when unset) and `isCartMgmtSupported` (string `'true'`/`'false'`, default `'false'`, read from `cc_routingAttributes`). Brings the PWA commerce-client path to parity with the SFRA cartridge.
 - [Feature] Enable shopper identity (customer context) for the Commerce Client (Cimulate) shopper-agent provider. Unlike MIAW, Commerce Client widgets do not expose `getAuthLinkKey`, so the browser extracts the Commerce Client JWT from the deployment-scoped `cim_af_ct_<orgId>_<embeddedServiceName>` key (`sessionStorage` is authoritative; `localStorage` is a compatibility fallback) and calls SCRT2's `/iamessage/api/v2/authorization/authlink` endpoint directly (`auth-link-client.js`) with an `Authorization: Bearer <jwt>` header to obtain an `auth_link_key`. The SCRT2 origin comes from `scrt2Url` in `COMMERCE_AGENT_SETTINGS` (a different host from Core's My Domain) and is strictly validated before the token is sent (HTTPS only; no credentials, port, path, query, or fragment) against the Salesforce SCRT2 domain allowlist, with the request hardened (`credentials: 'omit'`, `redirect: 'error'`, `referrerPolicy: 'no-referrer'`, `cache: 'no-store'`) and bounded by a 10s abort timeout. The `auth_link_key` is then forwarded to the existing Token Bridge to bind the conversation to the shopper's SLAS session. Linking is idempotent — deduped by `conversationId` + SLAS identity — and re-runs both on a new conversation (`onCimulateWidgetReady`) and on a SLAS identity transition (guest ↔ registered / account switch), gated on `my_domain` resolution. [#3943](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3943) [#3981](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3981)
 - [Bugfix] Restore Commerce Client shopper identity linking with widget 1.34.0+: read persisted conversation IDs from `localStorage` with a legacy `sessionStorage` fallback, and continue checking the other store when one contains the previously linked JWT so a stale session token cannot hide a newer local token. [#4033](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4033) (W-24293344)

package/app/components/inline-agent-widget/index.jsx

@@ -5,73 +5,15 @@
  * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/BSD-3-Clause
  */
 
-import React, {useEffect, useState} from 'react'
+import React from 'react'
 import {Helmet} from 'react-helmet'
 import PropTypes from 'prop-types'
-import {FormattedMessage} from 'react-intl'
-import {Alert, Box, Button, Text} from '@salesforce/retail-react-app/app/components/shared/ui'
 import useInlineAgentWidget, {
     isConfigured
 } from '@salesforce/retail-react-app/app/hooks/use-inline-agent-widget'
-import {handoffToShopperAgent} from '@salesforce/retail-react-app/app/utils/shopper-agent-handoff'
 
-const VALID_MODES = ['inline', 'shopper-agent', 'hybrid']
-const HANDOFF_EVENT = 'inline-agent-widget:handoff'
-
-const InlineAgentWidget = ({config, pdpQuestions, productName, productId}) => {
+const InlineAgentWidget = ({config, pdpQuestions, productName}) => {
     const containerRef = useInlineAgentWidget(config, {pdpQuestions, productName})
-    const [failedQuestions, setFailedQuestions] = useState([])
-    const mode = config?.mode
-    const configured = isConfigured(config)
-
-    useEffect(() => {
-        if (mode !== undefined && !VALID_MODES.includes(mode)) {
-            console.warn(
-                `InlineAgentWidget: unknown mode "${mode}". Expected one of ${VALID_MODES.join(
-                    ', '
-                )}. Falling back to 'inline'.`
-            )
-        }
-    }, [mode])
-
-    useEffect(() => {
-        setFailedQuestions([])
-        if (!configured || mode !== 'shopper-agent') return
-        if (typeof window === 'undefined') return
-
-        const controller = new AbortController()
-        const onHandoff = async (ev) => {
-            const question = ev.detail?.question
-            if (typeof question !== 'string' || !question.trim()) return
-            setFailedQuestions((previous) => previous.filter((item) => item.question !== question))
-            let result
-            try {
-                result = await handoffToShopperAgent({
-                    question,
-                    signal: controller.signal,
-                    productContext: {
-                        productId,
-                        productName,
-                        pdpUrl: window.location.href
-                    }
-                })
-            } catch (error) {
-                console.error('Shopper Agent handoff failed', error)
-            }
-            if (!controller.signal.aborted && !result?.seeded) {
-                setFailedQuestions((previous) => [
-                    ...previous.filter((item) => item.question !== question),
-                    {question, provider: result?.provider}
-                ])
-            }
-        }
-
-        document.addEventListener(HANDOFF_EVENT, onHandoff)
-        return () => {
-            controller.abort()
-            document.removeEventListener(HANDOFF_EVENT, onHandoff)
-        }
-    }, [configured, mode, productId, productName])
 
     if (!isConfigured(config)) return null
 
@@ -81,40 +23,6 @@ const InlineAgentWidget = ({config, pdpQuestions, productName, productId}) => {
                 <script src="/static/inline-agent-widget.umd.js" async></script>
             </Helmet>
             <div ref={containerRef} />
-            {failedQuestions.map(({question, provider}) => (
-                <Alert key={question} status="error" role="alert" marginTop={2}>
-                    <Box>
-                        <Text>
-                            {provider === 'miaw' ? (
-                                <FormattedMessage
-                                    id="inline_agent_widget.message.manual_handoff"
-                                    defaultMessage="This chat cannot receive questions automatically. Copy your question below and send it in the chat."
-                                />
-                            ) : (
-                                <FormattedMessage
-                                    id="inline_agent_widget.message.handoff_failed"
-                                    defaultMessage="We couldn't send your question to the assistant. Please try again."
-                                />
-                            )}
-                        </Text>
-                        <Text>{question}</Text>
-                        {provider !== 'miaw' && (
-                            <Button
-                                onClick={() =>
-                                    document.dispatchEvent(
-                                        new CustomEvent(HANDOFF_EVENT, {detail: {question}})
-                                    )
-                                }
-                            >
-                                <FormattedMessage
-                                    id="inline_agent_widget.button.retry"
-                                    defaultMessage="Try again"
-                                />
-                            </Button>
-                        )}
-                    </Box>
-                </Alert>
-            ))}
         </>
     )
 }
@@ -125,12 +33,22 @@ InlineAgentWidget.propTypes = {
         scrt2Url: PropTypes.string,
         orgId: PropTypes.string,
         esDeveloperName: PropTypes.string,
-        placeholder: PropTypes.string,
-        mode: PropTypes.oneOf(['inline', 'shopper-agent', 'hybrid'])
+        placeholder: PropTypes.string
     }),
+    /**
+     * Opener questions for the current product — rendered as tappable pills
+     * above the widget input. Typically sourced from the SCAPI
+     * `c_pdpQuestions` custom attribute (parsed via `parsePdpQuestions`).
+     */
     pdpQuestions: PropTypes.arrayOf(PropTypes.string),
-    productName: PropTypes.string,
-    productId: PropTypes.string
+    /**
+     * Current product's display name. Templated into the InputBar
+     * placeholder — "Ask me anything about <productName>" — so the shopper
+     * sees product-grounded prompting on PDP load. Sourced from the SCAPI
+     * `name` standard field. When absent, the widget falls back to the
+     * generic "Ask me anything" string.
+     */
+    productName: PropTypes.string
 }
 
 export default InlineAgentWidget

package/app/components/shopper-agent/index.jsx

@@ -707,8 +707,7 @@ const CommerceClientAgentWindow = ({
         cc_openLinksInNewTab,
         cc_showProductDescription,
         cc_showProductCaptions,
-        cc_promptsConfig,
-        cc_enablePageContext
+        cc_promptsConfig
     } = commerceAgentConfiguration
 
     const navigate = useNavigation()
@@ -1183,8 +1182,7 @@ const CommerceClientAgentWindow = ({
             onNavigate,
             showProductDescription: toOptionalWidgetBoolean(cc_showProductDescription),
             showProductCaptions: toOptionalWidgetBoolean(cc_showProductCaptions),
-            promptsConfig: cc_promptsConfig,
-            enablePageContext: toOptionalWidgetBoolean(cc_enablePageContext)
+            promptsConfig: cc_promptsConfig
         }),
         [
             commerceClientElementId,
@@ -1221,8 +1219,7 @@ const CommerceClientAgentWindow = ({
             onNavigate,
             cc_showProductDescription,
             cc_showProductCaptions,
-            cc_promptsConfig,
-            cc_enablePageContext
+            cc_promptsConfig
         ]
     )
 

package/app/hooks/use-commerce-client-messaging.js

@@ -87,8 +87,7 @@ const injectCommerceClientWidget = ({
     onNavigate,
     showProductDescription,
     showProductCaptions,
-    promptsConfig,
-    enablePageContext
+    promptsConfig
 } = {}) => {
     if (!onClient) return false
 
@@ -116,9 +115,6 @@ const injectCommerceClientWidget = ({
         if (typeof showProductCaptions === 'boolean') {
             messagingConfig.showProductCaptions = showProductCaptions
         }
-        if (typeof enablePageContext === 'boolean') {
-            messagingConfig.enablePageContext = enablePageContext
-        }
 
         commerceClient.injectMessagingWidget({
             elementId,

package/app/hooks/use-inline-agent-widget.js

@@ -39,12 +39,8 @@ const ensureWidget = () => {
     return readyPromise
 }
 
-const isConfigured = (config) => {
-    if (!config?.enabled) return false
-    // shopper-agent never opens a SCRT2 session — only `enabled` matters.
-    if (config?.mode === 'shopper-agent') return true
-    return Boolean(config?.scrt2Url && config?.orgId && config?.esDeveloperName)
-}
+const isConfigured = (config) =>
+    Boolean(config?.enabled && config?.scrt2Url && config?.orgId && config?.esDeveloperName)
 
 // Stable string key for the pdpQuestions array so the sync effect's dependency
 // is by value, not identity. An empty/undefined list serializes to "" so it
@@ -57,7 +53,6 @@ const useInlineAgentWidget = (config, {pdpQuestions, productName} = {}) => {
     const containerRef = useRef(null)
     const configured = isConfigured(config)
     const questionsKey = pdpQuestionsKey(pdpQuestions)
-    const mode = config?.mode
 
     useEffect(() => {
         if (typeof window === 'undefined') return
@@ -77,18 +72,13 @@ const useInlineAgentWidget = (config, {pdpQuestions, productName} = {}) => {
         if (containerRef.current.querySelector('inline-agent-widget')) return
 
         const el = document.createElement('inline-agent-widget')
-        if (mode) el.setAttribute('mode', mode)
-        // SCRT2 fields are only set when they're real — shopper-agent mode
-        // doesn't need them and the UMD's config-validation skips the check
-        // when `mode="shopper-agent"`.
-        if (config.scrt2Url) el.setAttribute('scrt2-url', config.scrt2Url)
-        if (config.orgId) el.setAttribute('org-id', config.orgId)
-        if (config.esDeveloperName) el.setAttribute('es-developer-name', config.esDeveloperName)
+        el.setAttribute('scrt2-url', config.scrt2Url)
+        el.setAttribute('org-id', config.orgId)
+        el.setAttribute('es-developer-name', config.esDeveloperName)
         el.setAttribute('capabilities-version', DEFAULT_EMBEDDED_AGENT_CAPABILITIES_VERSION)
         if (config.placeholder) el.setAttribute('placeholder', config.placeholder)
         if (config.persistSession !== false) el.setAttribute('persist-session', '')
         if (config.enableLogging) el.setAttribute('enable-logging', '')
-        if (config.preWarm !== false) el.setAttribute('pre-warm', '')
         // Seed pdp-questions at create time when we already have them, so the
         // pills paint in the same frame the widget mounts (no visible pop-in
         // from the attribute-sync effect below).
@@ -104,7 +94,7 @@ const useInlineAgentWidget = (config, {pdpQuestions, productName} = {}) => {
         return () => {
             el.remove()
         }
-    }, [configured, ready, config, mode])
+    }, [configured, ready, config])
 
     // Keep the pdp-questions attribute in sync with the current product. Runs
     // separately from element creation so a variant switch / SPA nav to a new

package/app/pages/product-detail/index.jsx

@@ -815,7 +815,6 @@ const ProductDetail = () => {
                                             productResponse?.c_pdpQuestions
                                         )}
                                         productName={productResponse?.name}
-                                        productId={productResponse?.id}
                                     />
                                 }
                             />