Add cimulate.ai and sfcc-store-internal.net to the Content Security
Policy directives (script-src, connect-src, img-src) in the
pwa-kit-create-app ssr.js.hbs templates. This mirrors the CSP changes
already applied to template-retail-react-app in PR #3890, ensuring
newly scaffolded projects also allow the Commerce Client messaging
widget to load and connect.

Add cimulate.ai and sfcc-store-internal.net to the Content Security
Policy directives (script-src, connect-src, img-src) in the
pwa-kit-create-app ssr.js.hbs templates. This mirrors the CSP changes
already applied to template-retail-react-app in PR #3890, ensuring
newly scaffolded projects also allow the Commerce Client messaging
widget to load and connect.

Add cimulate.ai and sfcc-store-internal.net to the Content Security
Policy directives (script-src, connect-src, img-src) in the
pwa-kit-create-app ssr.js.hbs templates. This mirrors the CSP changes
already applied to template-retail-react-app in PR #3890, ensuring
newly scaffolded projects also allow the Commerce Client messaging
widget to load and connect.

…cycle (#3930)

* Bump versions and update changelogs for 3.19.0-preview.0 release (#3920)

* feat: add Commerce Client CSP entries to create-app templates

Add cimulate.ai and sfcc-store-internal.net to the Content Security
Policy directives (script-src, connect-src, img-src) in the
pwa-kit-create-app ssr.js.hbs templates. This mirrors the CSP changes
already applied to template-retail-react-app in PR #3890, ensuring
newly scaffolded projects also allow the Commerce Client messaging
widget to load and connect.

* @W-23406559@ - Storefront Preview: honor x-pwakit-preview-parent header for session-cookie SameSite (#3922)

* @W-23406559@ - Storefront Preview: honor x-pwakit-preview-parent header for session-cookie SameSite

The __Host-pwakit_preview_ctx marker cookie set on the iframe document load can be bypassed by a CDN cache hit (the document is cacheable via s-maxage), so session cookies fall back to SameSite=Lax and are blocked in the cross-site Runtime Admin preview iframe.

Add a client-sent x-pwakit-preview-parent header (set by commerce-sdk-react when the storefront detects it is framed by a trusted, non-localhost Runtime Admin parent). It rides the never-cached SLAS token POST so it always reaches the origin. The BFF re-validates the header against STOREFRONT_PREVIEW_PARENT_ALLOW_LIST and, when trusted, issues session cookies as SameSite=None; Partitioned. Either signal (marker cookie or header) now suffices. The header is stripped before forwarding upstream to SLAS/SCAPI.

* @W-23406559@ - Strip x-pwakit-preview-parent upstream regardless of HttpOnly flag

The private-client SLAS proxy is wired whenever useSLASPrivateClient is
true, independent of MRT_ENABLE_HTTPONLY_SESSION_COOKIES, but the
x-pwakit-preview-parent strip lived inside handleHttpOnlyCookiesOnProxyReq
which only runs when the flag is on. A private-client deploy with the flag
off would therefore forward the internal preview-context header upstream to
SLAS.

Move the removeHeader(X_PREVIEW_PARENT) call out of the helper and run it
unconditionally right after applyProxyRequestHeaders() in both the private-
and public-client onProxyReq handlers. Add a regression test asserting the
header never reaches the upstream SLAS mock with the flag off.

* @W-23409029@ - Preserve SSR guest-login token when cookieDomain is set (order host-scoped deletion before Domain write) (#3924)

* @W-23409029@ - Preserve SSR guest-login token when cookieDomain is set (order host-scoped deletion before Domain write)

When commerceAPI.cookieDomain is set, makeAppendCookie now emits the host-scoped cookie deletion BEFORE the real Domain-scoped cookie. On a cookieless SSR load, commerce-sdk-isomorphic reconstructs the guest-login TokenResponse from the response's Set-Cookie headers with last-write-wins per name; the prior order let the trailing empty host-scoped deletion clobber the real token, leaving the SSR shopper token empty and 401-ing data-bearing routes (e.g. a PLP deep link). Regression of W-23388089. Browser cookie scoping (host vs Domain) is order-independent, so no browser-side behavior change.

* @W-23409029@ - Fix refresh-token SSR clobber; lock cookie emission order with tests

Addresses review feedback on #3924:

- Emit the opposite-refresh-cookie deletion (cc-nx / cc-nx-g) BEFORE the
  real refresh-token write. Both names map to refresh_token in
  commerce-sdk-isomorphic's SSR TokenResponse reconstruction
  (last-write-wins per token field, Domain ignored), so a trailing empty
  deletion clobbered the reconstructed refresh_token. Latent regardless of
  cookieDomain; benign only because SSR does not refresh within the request.
- Add a raw-emission-order test (host-scoped deletion before the real
  Domain write, for cc-at and cc-nx-g) and an SSR last-write-wins
  reconstruction test that recovers both the access and refresh tokens,
  with and without cookieDomain.
- Extend the CHANGELOG Bug Fix entry to cover the refresh-token path.

* @W-23409029@ - Address PR review: registered/logout/idp reconstruction tests + SDK pointer

Follow-up to #3924 review feedback:

- Add a registered-login reconstruction test (mirror of the guest case:
  cc-nx is the real refresh cookie, cc-nx-g the empty opposite-deletion), so
  the deletion-before-real ordering is pinned for both branches.
- Add a logout test asserting both cc-nx and cc-nx-g are emitted empty, so SSR
  cannot reconstruct a refresh token after expireHttpOnlySessionCookies.
- Extend the reconstruction test and the reconstructSsrTokens helper to also
  cover idp_access_token (SDK-reconstructed and body-stripped, same
  deletion-before-real ordering dependency as the access token).
- Document the cross-repo invariant in makeAppendCookie: the parser is
  commerce-sdk-isomorphic's server-side TokenResponse reconstruction
  (helpers/slasHelper), last-write-wins keyed by cookie name (Domain ignored);
  revisit this emission order if a future SDK version changes that.
- Fix prettier line-wrap in the test file (CI lint).

* Bump versions and update changelogs for 3.19.0 release (#3929)

* Bump versions to next dev cycle

Monorepo/SDK 3.19.0 -> 3.20.0-dev, commerce-sdk-react 5.3.0 -> 5.4.0-dev,
retail-react-app 10.1.0 -> 10.2.0-dev. pwa-kit-mcp is left at 0.5.0
(released independently, pinned to its latest published npm version).

---------

Co-authored-by: sf-praveen-ningappa <pningappa@salesforce.com>