@salesforce/retail-react-app 11.0.0-preview.0 → 11.0.0

package/CHANGELOG.md

@@ -1,24 +1,26 @@
-## v11.0.0-preview.0 (Nov 09, 2026)
+## v11.0.0 (Nov 10, 2026)
 - [Feature] Export `getDynamicRoutes(config)` from `app/routes` so projects that extend this template can include the config-gated routes (reset password and passwordless login landing pages, social login redirect, guest order lookup, Shopper Agent express payment).
 - [Security] Require `login_id` and `channel_id` on passwordless OTP token exchange (`loginPasswordless`) from the login page, auth modal, and one-click checkout contact/registration flows, so SLAS can reject mismatched identifiers. Map SLAS 400 missing/mismatched-identifier errors and passwordless rate limits (429) to existing OTP/login UX, and map password/action rate limits (429) to the too-many-password-reset-attempts UX. Depends on `@salesforce/commerce-sdk-react@6.0.0` (breaking major; pairs with `commerce-sdk-isomorphic@5.8.0`). [#4075](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4075)
 - [Security] Passwordless magic links no longer carry the shopper email. When the shopper opens the link in the browser that requested it, the login landing page sends the email remembered at request time (stored in `localStorage` for 15 minutes) as `login_id`; in any other browser or device it keeps the token and asks the shopper to confirm their email to finish signing in. A `login_id` query parameter (for example in a merchant-configured `email` mode link) is still accepted. Token exchange failures on the landing page are now shown instead of leaving the shopper on the sign-in page with no feedback. **Upgrade note:** if your project overrides the login page, auth modal, or one-click checkout contact/registration components, call `rememberPasswordlessLoginId(email)` after each successful `authorizePasswordless` call so same-browser magic links sign in without the extra step. Both remembered emails are cleared on logout; if you add your own logout action, call `clearRememberedAuthEmails()` there too. [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Feature] The reset password landing page prefills the email when the shopper opens the link in the browser that requested it (stored in `localStorage` for 15 minutes, separately from the passwordless email, and cleared after a successful reset). In any other browser the shopper enters it as before. The reset link still carries only the token. [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Enhancement] Update guest order lookup copy per the UI text review: the request page now reads "Order Lookup" with revised intro text, title-case field labels, and a "Find Order" button; the verify page uses "Enter the verification code that we sent to {email}.". Remove the placeholder "Order Status" footer link, which pointed to the home page. [#4090](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4090)
 - [Bugfix] Keep Commerce Client shopper-agent product links on the PWA Kit storefront. The agent backend sends product links as SFRA URLs on the backend origin (e.g. `/en_US/<slug>-<id>.html`), which the widget's `onNavigate` never sees, so clicking a product card left for the SFRA PDP. The storefront now reads the product id from those links in the widget's product slots (cards, product detail title, comparison columns), rewrites their `href` to the PWA product page, and routes plain clicks through the router. Links in agent message text are left alone. When the product id is not certain from the URL (the last path segment contains `-`, so it may be a name slug and id, or an id that contains `-`), it is resolved through Shopper SEO `getUrlMapping`; if that finds no product the link keeps its backend URL rather than pointing at a storefront 404. [#4076](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4076)
+- [Enhancement] Increase the `main.js` bundle-size budget from 109 kB to 111 kB for the Shopper Agent express-payment iframe framework, and the `vendor.js` budget from 403 kB to 412 kB for the embedded Page Designer content blocks. [#4063](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4063), [#4042](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4042)
 - [Feature] Add a neutral Shopper Agent express-payment iframe framework with cart and product routes, a merchant provider lifecycle contract, validated iframe-to-host events, and automatic iframe sizing. [#4063](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4063)
-- [Changed] Rename `pwakit-notify` notification types to flow-based names: `passwordless-magic-link` → `passwordless-login`, `otp` → `password-registration`. Adds new `passwordless-registration` type for new-user magic-link delivery — intentionally skips the anti-enumeration account-existence check (correct for the new-user registration flow). The cartridge changes are aligned 1-to-1 with sf-next PR #2946. [Security] Cross-validate `email_id` from the SLAS callback JWT against the request body in the passwordless-login callback, preventing email relay via an arbitrary-recipient registration email when `register=true`.
+- [Changed] Rename `pwakit-notify` notification types to flow-based names: `passwordless-magic-link` → `passwordless-login`, `otp` → `password-registration`. Adds new `passwordless-registration` type for new-user magic-link delivery — intentionally skips the anti-enumeration account-existence check (correct for the new-user registration flow).
+- [Security] Cross-validate `email_id` from the SLAS callback JWT against the request body in the passwordless-login callback, preventing email relay via an arbitrary-recipient registration email when `register=true`.
 - [Security] Cross-validate `email_id` and `token` claims in the SLAS callback JWT against the request body in the registration-verification callback (`/registration-verification-callback`), preventing email-relay attacks where a caller with a valid tenant-signed guest token could trigger OTP delivery to an arbitrary address. [#4067](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4067)
 - [Bugfix] Gate the GLO magic-link auto-submit on `emailFromContext` (email present in router state) rather than the derived `email` variable, so arriving directly via magic link no longer attempts an auto-submit before the user enters their email address. [#4067](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4067)
 - [Enhancement] Update inline agent widget UMD bundle: add follow-up suggestion pills from agent responses, and send `commerce_agent_context` as a TextValue JSON string. Bump the embedded agent `capabilitiesVersion` to `66` (new `DEFAULT_EMBEDDED_AGENT_CAPABILITIES_VERSION` constant, separate from the Commerce Client's `65`) for context-variable support. Built from [inline-agent-widget#17](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/17) and [inline-agent-widget#18](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/18). [#4061](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4061)
-- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 to avoid an npm 10 dependency resolver crash during fresh installs while the Vitest browser packages require 4.1.11.
+- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 to avoid an npm 10 dependency resolver crash during fresh installs while the Vitest browser packages require 4.1.11. [#4064](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4064)
 - [Bugfix] Fix `useScript` remount when the script tag is already in the DOM. ShopperAgent (and other consumers) stayed at `loaded: false` after a remount because the existing tag never fired `load` again, so the Commerce Client widget did not re-inject. The hook now stamps `data-script-status` on load/error and only reports `loaded: true` when that status is `ready`; an in-flight tag stays unloaded until it finishes. [#4062](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4062)
-- [Bugfix] Route Commerce Client widget product/checkout/markdown clicks through the storefront `useNavigation` router via the widget's `onNavigate` callback, so same-tab same-origin links stay in the SPA instead of triggering a full page load. Requires Commerce Client widget `1.48.0+`. `cc_openLinksInNewTab: "true"` is unchanged and still opens a new tab. Also fixes `buildUrl` (`createUrlTemplate`) when site/locale are configured as `query_param`: paths that already have a query string or hash now get site/locale merged into the existing query instead of a second `?` appended (which previously corrupted params like `q`/`pid` and swallowed the hash).
+- [Bugfix] Route Commerce Client widget product/checkout/markdown clicks through the storefront `useNavigation` router via the widget's `onNavigate` callback, so same-tab same-origin links stay in the SPA instead of triggering a full page load. Requires Commerce Client widget `1.48.0+`. `cc_openLinksInNewTab: "true"` is unchanged and still opens a new tab. Also fixes `buildUrl` (`createUrlTemplate`) when site/locale are configured as `query_param`: paths that already have a query string or hash now get site/locale merged into the existing query instead of a second `?` appended (which previously corrupted params like `q`/`pid` and swallowed the hash). [#4035](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4035)
 - [Enhancement] Update inline agent widget UMD bundle: replace the text-prefix product-context hack with the proper SCRT2 v2 session-context API. Product context is now sent as a `commerce_agent_context` StructuredValue in the SessionContextSet envelope, leaving the shopper's message text unchanged. Default `capabilitiesVersion` bumped to `"65"`. Built from [inline-agent-widget#3](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/3). [#4054](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4054)
 - [Feature] Add `app_pwakit_base` B2C cartridge for transactional email delivery via ISML templates and `dw/net/Mail`. GLO access-code emails use the `sfcc.app.order.sendOrderAccessCode` hook; passwordless login, OTP verification, and password reset use the `pwakit-notify` Custom REST API (`POST .../organizations/{orgId}/notify?siteId={siteId}`, guarded by the `c_pwakit_notify` SLAS scope). Deploy with `npm run deploy:cartridge` from `packages/template-retail-react-app` (uses `b2c-cli` with `--reload` to upload the cartridge and re-register the SCAPI endpoint in one step), then import `OrganizationPreferences.xml` to enable the `pwakitNotifyEnabled` and `pwakitStorefrontHost` site preferences. **Required: create a dedicated private SLAS client** (`notifyClientId`) scoped only to `c_pwakit_notify`, set `PWA_KIT_NOTIFY_SLAS_CLIENT_SECRET` to its secret, and add `notifyClientId` to `commerceAPI.parameters` in your config. **Do not add `c_pwakit_notify` to the shopper/public client** — doing so makes browser-minted guest tokens capable of calling the notification API directly, reopening the email-relay risk this design is intended to close. See `cartridges/app_pwakit_base/README.md` for full setup steps. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - [Breaking change] `config/default.js` now sets `mode: 'callback'` for both `passwordless` and `resetPassword` flows (previously `'email'`). This routes password-reset confirmation through the SSR `/reset-password-callback` route and the new `pwakit-notify` cartridge. **Projects that adopt this config without deploying the cartridge will have broken password resets** — there is no `resetPassword.enabled` guard (unlike `passwordless.enabled`). Either deploy the cartridge before adopting the config change, or explicitly override `resetPassword.mode` back to `'email'`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - [Breaking change] Marketing Cloud email delivery is removed from `app/ssr.js`. The `emailLink` function and the `MARKETING_CLOUD_CLIENT_ID`, `MARKETING_CLOUD_CLIENT_SECRET`, `MARKETING_CLOUD_SUBDOMAIN`, `MARKETING_CLOUD_PASSWORDLESS_LOGIN_TEMPLATE` and `MARKETING_CLOUD_RESET_PASSWORD_TEMPLATE` environment variables are no longer read. Passwordless login, password reset and registration emails are now sent through the `pwakit-notify` endpoint of the `app_pwakit_base` cartridge. Projects that send these emails through Marketing Cloud must deploy the cartridge and configure `notifyClientId` and `PWA_KIT_NOTIFY_SLAS_CLIENT_SECRET`, or keep their own copy of the previous `emailLink` implementation in an overridden `ssr.js`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
-- [Breaking change] `config/default.js` now sets `passwordless.enabled` to `true` (previously `false`). Combined with `mode: 'callback'`, projects that inherit this config need the `app_pwakit_base` cartridge deployed or must set `passwordless.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
-- [Breaking change] `config/default.js` now sets `guestOrderLookup.enabled` to `true` (previously `false`). This enables the `/order-lookup` routes and the order access code email, which is sent by the cartridge's `sendOrderAccessCode` hook. Deploy the `app_pwakit_base` cartridge or set `guestOrderLookup.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] `config/default.js` now sets `passwordless.enabled` to `true` (previously `false`); projects generated with `create-app` use a bootstrap config that keeps it `false`. Combined with `mode: 'callback'`, projects that inherit this config need the `app_pwakit_base` cartridge deployed or must set `passwordless.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
+- [Breaking change] `config/default.js` now sets `guestOrderLookup.enabled` to `true` (previously `false`); projects generated with `create-app` use a bootstrap config that does not enable it. This enables the `/order-lookup` routes and the order access code email, which is sent by the cartridge's `sendOrderAccessCode` hook. Deploy the `app_pwakit_base` cartridge or set `guestOrderLookup.enabled` back to `false`. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - [Breaking change] Projects that override passwordless or reset password code must update their calls: `loginPasswordless` now needs `login_id` (the email sent to `authorizePasswordless`) and `channel_id` (the site id), and `resetPassword` now needs `user_id` (the email the reset was requested for). See the `@salesforce/commerce-sdk-react` 6.0.0 changelog. [#4075](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4075), [#4092](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4092)
 - [Bugfix] Fix GLO `/api/guestOrderLookup/verify` and related server endpoints returning 401 when `enablePWAKitPrivateClient` is enabled. The `cc-nx-g_` cookie stores the SLAS refresh token, not the access token — the access token is never stored in any cookie. All GLO server endpoints now read the SLAS JWT from the `Authorization` header sent by the client (via `useAccessToken().getTokenWhenReady()`), which works correctly in both public and private client modes. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - [Enhancement] End the Commerce Client shopper-agent conversation when a registered shopper logs out, instead of re-linking it to the guest. Uses the widget's `eventHandlers.session.endConversation()` (`cc_cdnVersion` >= `1.39.0`), falls back to `resetConversation()` on `1.36.0`–`1.38.x`, and to re-linking before `1.36.0`. Also keeps the widget mounted through the login/logout basket reload so the bundle is not injected twice. [#4051](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4051)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/retail-react-app",
-  "version": "11.0.0-preview.0",
+  "version": "11.0.0",
   "license": "See license in LICENSE",
   "author": "cc-pwa-kit@salesforce.com",
   "ccExtensibility": {
@@ -47,10 +47,10 @@
     "@loadable/component": "^5.15.3",
     "@peculiar/webcrypto": "^1.4.2",
     "@salesforce/cc-datacloud-typescript": "1.1.2",
-    "@salesforce/commerce-sdk-react": "6.0.0-preview.0",
-    "@salesforce/pwa-kit-dev": "3.22.0-preview.0",
-    "@salesforce/pwa-kit-react-sdk": "3.22.0-preview.0",
-    "@salesforce/pwa-kit-runtime": "3.22.0-preview.0",
+    "@salesforce/commerce-sdk-react": "6.0.0",
+    "@salesforce/pwa-kit-dev": "3.22.0",
+    "@salesforce/pwa-kit-react-sdk": "3.22.0",
+    "@salesforce/pwa-kit-runtime": "3.22.0",
     "@salesforce/storefront-next-runtime": "1.3.1",
     "@tanstack/react-query": "^4.28.0",
     "@tanstack/react-query-devtools": "^4.29.1",
@@ -117,5 +117,5 @@
       "maxSize": "412 kB"
     }
   ],
-  "gitHead": "48bba63cf8923a3cebce31ffa0d81dba52673ce2"
+  "gitHead": "bf8d259ab581af6a5808c264403b3606d0fad06a"
 }