PWA Kit 3.19.0 introduces full Order Management (returns, cancellation, and tracking) on the storefront, expands the Shopper Agent with authenticated customer context, adds SSR distributed tracing and a maintenance-mode experience, continues hardening the opt-in HttpOnly session-cookie mode, and delivers important security upgrades.

🛒 OMS Shopper Orders (Order Management)

• Order tracking — per-shipment OrderTracking card (carrier/method name, localized shipment status, tracking-number link, expected/actual delivery dates from omsData.shipments[]), a "Track Shipment" order action (single button / multi-shipment dropdown / disabled state), per-shipment item boxes on the order-detail page, and a safe external-URL helper. #3865 #3867 #3872 #3898 #3906
• Order-action hooks — cancelOmsOrder / returnOmsOrder mutations and the getOmsMetaData query (return/cancel reason codes) with cache invalidation. #3864 #3869
• Item-level order returns on the order-detail page — a modal with per-item quantity + reason, inline feedback, and a return-progress status badge (handles partially-returned multi-unit lines). #3904
• Cancel order modal for not-yet-shipped OMS-managed orders, with reason-code selection. #3861
• getOrderDisplayStatus util aggregating item-level OMS statuses into a single order-level display status. #3900
• Bumped commerce-sdk-isomorphic to 5.4.0 (first stable release with the OMS Shopper Orders endpoints).

🤖 Shopper Agent

• Customer context for Shopper Agent — on conversation start, forwards the shopper's SLAS session to Core's Token Bridge via a same-origin PWA Kit proxy (access token in the body for non-HttpOnly mode; both tokens read server-side from cookies in HttpOnly mode), and resets the messaging session on guest ↔ registered transitions so the agent never inherits a stale identity. #3890
• Commerce Client as an optional shopper-agent provider — a new commerceAgent.provider switch (miaw default vs commerce-client); the Commerce Client UMD bundle is allowlisted to *.cimulate.ai with a configurable display mode. Existing MIAW storefronts are unaffected. #3925

📊 Distributed Tracing

• SSR render-path distributed tracing (production-gated) — a W3C ssr.render server span plus route-match/getProps/render-to-string and per-SCAPI scapi:<name> child spans parented on the incoming traceparent; exposes res.locals.traceparent for outbound propagation. Off → no-op. #3889
• Reports the matched route template as the low-cardinality http.route span attribute. #3917
• The retail template and create-app forward traceparent on CommerceApiProvider so SSR-time SCAPI/SLAS calls carry trace context. #3889

🧰 Maintenance Mode

• MaintenanceError (503) propagated through the SSR and client error pipelines; throwOnMaintenanceHeader: true by default so sfdc_maintenance responses throw automatically. #3827
• Maintenance page — renders a shared CDN-hosted page (default) or a built-in fallback; configured via app.pages.maintenancePage. #3827

🗄️ MRT Data Store

• Added the MrtDataStoreProvider context and useCustomSitePreferences / useCustomGlobalPreferences hooks (SSR-integrated; client reads window.__MRT_DATA_STORE__). #3811
• Bug Fix: aligned the client/server signatures of getCustomSitePreferences / getCustomGlobalPreferences (both async, same params) for React Query + SSR prepass patterns. #3811

🛡️ HttpOnly Session Cookies

• commerceAPI.cookieDomain support — when set, the SLAS proxy attaches Domain= to every Set-Cookie it emits and expires the host-scoped versions for clean migration (mirrors the client-side behavior). #3782
• Bug Fix — SSR token reconstruction (401 on data routes): the SLAS proxy now emits the host-scoped cookie deletion before the real Domain= cookie. On a cookieless SSR load the SDK reconstructs the token from Set-Cookie via last-write-wins per cookie name; the old order let the trailing empty deletion clobber the real token, causing 401s on data-bearing routes (e.g. a PLP deep link). The same fix applies to the refresh token (cc-nx/cc-nx-g).
• SCAPI Authorization pass-through & normalization: a valid Bearer <jwt> is now passed through to SCAPI unchanged (no longer overwritten by a stale/empty cookie), and incoming bearers are normalized to canonical Bearer. Closes cold-tab and hard-refresh 401s on PLP/PDP routes. #3859
• Cookie-metadata migration: SLAS metadata (customer_id, customer_type, enc_user_id, id_token, idp_refresh_token) moved from localStorage to proxy-set cookies; cc-nx-exists + refresh_token_expires_in replaced by a single cc-nx-expires (absolute expiry); added a useCookie hook. customer_id/customer_type now expire with the access token and re-issue on every token response. #3830 #3858
• Refresh-and-retry on SCAPI 401 instead of rendering a hard error page (invalid-but-unexpired token → refresh off the still-valid refresh token, retry once). Applies to both HttpOnly and localStorage modes. #3860
• Preserve SCAPI/SFRA error details — handleInvalidToken reads the error body from a clone so callers can still read details (e.g. an SFRA-hook dw.system.Status.ERROR on a 400).
• Fix stale sfdc_dwsid affinity header in CommerceApiProvider (a missing dwsid dependency could send a stale header, risking wrong/expired app-server routing on hybrid storefronts).

🖼️ Storefront Preview Updates

• Server-only __Host-pwakit_preview_ctx marker cookie set for trusted Runtime Admin iframe loads; adds Partitioned (CHIPS) support to the BFF cookie serializer; CSP now includes staging/preview Runtime Admin hosts. #3850
• SLAS proxy issues session cookies as SameSite=None; Partitioned for trusted preview parents; logout clears the marker. Resolves requestUsid timeout / access_token_cookie_missing 400s inside the preview iframe. #3851
• Follow-on fix: honors an x-pwakit-preview-parent header as an alternate trusted-preview signal for when the cacheable iframe document load is served from CDN cache and bypasses the marker writer.
• Extended IFRAME_HOST_ALLOW_LIST to include the soak and testing Runtime Admin environments. #3850
• Bugfix: Storefront Preview session loss with HttpOnly cookies enabled (the client now sends the trusted parent origin on the never-cached SLAS token request).

⚡ Storefront Performance & UX (retail template)

• SSR-open search refinements panels — replaced the ChakraUI v2 Accordion (which forces items closed in SSR) with a controlled disclosure, removing a post-hydration relayout that could become the PLP largest-contentful-paint element.
• Memoized the search refinements panel to stop needless re-renders. #3855
• PayPal/Venmo express checkout — resolves the buyer-approved address from the upstream PayPal Order and PATCHes the basket payment instrument on shipping-address change so the review screen reflects the new amount and shipping options. #3868
• Sync amount on the basket payment instrument before placing the order so the persisted PaymentTransaction matches orderTotal.
• Carrier tracking links now use rel="noopener noreferrer" so the order-page URL doesn't leak as the Referer.
• Bundle-size budget adjustments: vendor.js 395 → 398 kB, main.js 102 → 103 kB. #3834 #3868

🔒 Security

• Upgraded @salesforce/mrt-utilities ^0.1.6 → ^0.2.2, eliminating the fast-xml-parser dependency and resolving CVE-2026-26278 (Critical) plus CVE-2025-23333, CVE-2024-55565, CVE-2024-41818, CVE-2024-41810, CVE-2023-52426, and CVE-2023-34104 (now on AWS SDK 3.1049.0). #3911
• Upgraded all @opentelemetry/* packages ^1.15.1 → ^2.8.0 to resolve GHSA-8988-4f7v-96qf (unbounded memory allocation). [#3911](#39...

PWA Kit 3.18.1 is a patch release that fixes Page Designer integration, pins a broken dependency, and fixes verdaccio config for generated project tests.

Highlights

• 🧩 Page Designer Integration Fix — Add contentLinkUuid support to fix Page Designer component linking in commerce-sdk-react. (#3839)
• 📦 Verdaccio Fix — Fix verdaccio config to not proxy monorepo @salesforce/* packages, ensuring locally published versions are used in generated project tests. (#3842)
• 🔧 @formatjs/cli Pin — Pin @formatjs/cli to avoid broken native binaries in generated projects.
• ⚛️ react-router Override — Add react-router override for @salesforce/storefront-next-runtime in generated project template. (#3839)

Package Changes

@salesforce/commerce-sdk-react@5.2.1

• Add contentLinkUuid support to fix Page Designer integration #3839

@salesforce/pwa-kit-create-app@3.18.1

• Add react-router override for @salesforce/storefront-next-runtime in generated project template #3839
• Fix verdaccio config to not proxy monorepo @salesforce/* packages #3842

@salesforce/pwa-kit-runtime@3.18.1

• Patch version bump (no functional changes)

@salesforce/pwa-kit-react-sdk@3.18.1

• Patch version bump (no functional changes)

@salesforce/pwa-kit-dev@3.18.1

• Patch version bump (no functional changes)

Full Changelog: v3.18.0...v3.18.1

PWA Kit 3.18 ships a security hardening release for the SLAS private-client proxy alongside two opt-in observability/storage features (HttpOnly session cookies, MRT Data Store), a memory-leak fix for warm Lambda invocations, and assorted Express Checkout, cookie-domain, and template polish.

Highlights

• 🔒 SLAS Proxy Security Hardening — The SLAS private-client proxy now enforces a path-and-method allow-list with iterative path normalization. The legacy applySLASPrivateClientToEndpoints option is replaced by slasPrivateClientAllowList, with additional logging and error handling for SLAS error scenarios. (#3802, #3812, #3750)
• 🍪 HttpOnly Session Cookies (WIP, opt-in) — Opt-in support for HttpOnly session cookies to protect SLAS tokens. Disabled by default; enable via enableHttpOnlySessionCookies in ssrParameters. (#3804, #3816)
• 💾 MRT Data Store Integration — Opt-in support for resolving custom site and global preferences from the MRT Data Store during SSR. New getCustomSitePreferences / getCustomGlobalPreferences helpers; local in-memory provider via @salesforce/mrt-utilities conditional exports for dev without DynamoDB. (#3787, #3811)
• 🚀 SSR QueryClient Memory Fix — Fixes SSR QueryClient memory retention across warm Lambda invocations, reducing memory pressure in production. (#3795)
• 🍪 Configurable Auth Cookie Domain — Auth-related cookies domain can now be set via config to support shared-session scenarios across subdomains. (#3782, #3822)
• 💳 Express Checkout Per-Page Toggles + return_url — Per-page express checkout toggles (expressOnCheckoutPagesEnabled) from Shopper Configurations API control express payment buttons on PDP, minicart, cart, and checkout individually. Added return_url for express checkout payment confirmation, required by redirect-based payment methods like Amazon Pay. (#3775, #3803)
• 🌐 Proxy User-Agent Preservation Flag — New option to preserve the original User Agent header in proxy requests. (#3798)
• 🎨 Alert Styling Fix — Fixed alert description text styling on subscribe form to not override default alert styles. (#3780)

Package Changes

@salesforce/pwa-kit-runtime@3.18.0

• Add option to keep original User Agent header in proxy requests #3798
• WIP: Add support for HttpOnly session cookies #3804
• Data Store Simplified: Removed internal provider pattern and dynamic loading. Now imports data store directly from @salesforce/mrt-utilities@0.1.6+ via conditional exports (dev-data-store). Local data store uses MRT_DATA_STORE_DEFAULTS and MRT_DATA_STORE_WARN_ON_MISSING (legacy PWAKIT_MRT_DATA_STORE_ENABLED still supported). #3811
• Add isMrtDataStoreEnabled(config) opt-in gate for SSR Data Store bootstrap. Controlled by app.mrtDataStore.enabled or PWAKIT_MRT_DATA_STORE_ENABLED. #3787
• Add getCustomGlobalPreferences / getCustomSitePreferences helpers (server async fetch, client reads window.__MRT_DATA_STORE__). #3787
• The SLAS private-client proxy now enforces a path-and-method allow-list with iterative path normalization. The legacy applySLASPrivateClientToEndpoints option is replaced by slasPrivateClientAllowList. #3802
• Add additional logging and error handling for SLAS error scenarios. #3750
• Refactor: Extract reusable SLAS proxy helpers. #3812
• Fix SSR QueryClient memory retention across warm Lambda invocations. #3795

@salesforce/pwa-kit-react-sdk@3.18.0

• Update @salesforce/pwa-kit-runtime dependency for the simplified data store implementation. #3811
• Add configuration flag enableHttpOnlySessionCookies to ssrParameters (WIP, disabled by default). #3804
• Serialize custom site and global preferences into #mobify-data under __MRT_DATA_STORE__ during SSR when enabled. #3787
• Fix SSR QueryClient memory retention across warm Lambda invocations. #3795

@salesforce/pwa-kit-dev@3.18.0

• Add option to keep original User Agent header in proxy requests. #3798
• WIP: Add support for HttpOnly session cookies. #3804
• Removed mrt-data-store-local-provider.js and related code; local data store now lives in @salesforce/mrt-utilities@0.1.6+. #3811
• Webpack: added dev-data-store to conditionNames in development mode. #3811

@salesforce/pwa-kit-create-app@3.18.0

• Add opt-in app.mrtDataStore.enabled to generated config/default.js templates (default false); local defaults documented via MRT_DATA_STORE_DEFAULTS. #3787 #3811 #3823
• Allow auth related cookies domain to be set via config. #3782
• Update generated app/ssr.js guidance for the SLAS private-client proxy: replace deprecated applySLASPrivateClientToEndpoints example with a pointer to slasPrivateClientAllowList. #3802
• WIP: Add support for HttpOnly session cookies. #3804
• Add Node 24 support to the extensible app template's generated package.json. #3821

@salesforce/commerce-sdk-react@5.2.0

• Allow auth related cookies domain to be set via config. #3782
• WIP: Add support for HttpOnly session cookies. #3804
• Re-add cookieDomain parameter to the Auth constructor; previously dropped during a merge. #3822

@salesforce/retail-react-app@10.0.0

⚠️ Breaking changes

• Major bump from 9.x → 10.0.0 due to component-override breaking changes (express checkout hooks, alert styling, per-page checkout logic). #3818

Features

• Add opt-in app.mrtDataStore.enabled to config/default.js. Local defaults via MRT_DATA_STORE_DEFAULTS. #3787
• Allow auth related cookies domain to be set via config. #3782
• WIP: Add support for HttpOnly session cookies. #3804

Bug fixes

• Fix per-page Express Checkout toggles using expressOnCheckoutPagesEnabled from Shopper Configurations API. #3775
• Add return_url for Express Checkout payment confirmation, required by redirect-based payment methods like Amazon Pay. #3803
• Fix alert description text styling on subscribe form to not override default alert styles. #3780

Documentation

• Update MRT Data Store config comments and README to use the unprefixed env vars actually consumed by @salesforce/mrt-utilities. #3811 #3823
• Update app/ssr.js SLAS private-client proxy guidance: pointer to slasPrivateClientAllowList. #3802

Full Changelog: v3.17.1...v3.18.0

What's Changed

• Adds Node 24 support. Dropped Node 16
• Updates the ECOM instance a newly generated app points to

Full Changelog: v2.10.0...v2.11.0

This follow up to PWA Kit 3.17.0 adds support for environment base paths.

The environment base path is set on bundle upload and lets you map PWA bundles deployed on MRT environments with a url path prefix. This enables projects to map their PWA applications under sub paths to their domain.

Base paths are set by adding a envBasePath property to the ssrParameters in your default.js config file.
By setting a base path, it is added to express routes such as /mobify or /callback.

If you want to include the base path in your page urls as well, set app.url.showBasePath to true.

Package Changes

@salesforce/retail-react-app@9.1.1

• Update storefront preview to support base paths #3614

@salesforce/commerce-sdk-react@5.1.1

• Update storefront preview to support base paths #3614
• Remove base path from /__pwa-kit route requests when showBasePath is false #3758

@salesforce/pwa-kit-runtime@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614
• Remove base path from /__pwa-kit route requests when showBasePath is false #3758-

@salesforce/pwa-kit-create-app@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

@salesforce/pwa-kit-dev@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

@salesforce/pwa-kit-react-sdk@3.17.1

• Add base path prefix to support multiple MRT environments under 1 domain #3614

Highlights

💳 Salesforce Payments - Stripe, Adyen, and PayPal payment processing via SF Payments is now available
📝 Page Designer - OOTB support for page desginer in PWA
🚀 : Marketing - Ability to subscriptions to marketing communications have been added to the footer
🛠️ Node 24 support - Node 24 added, Node 16 removed
⬆️ commerce-sdk-isomorphic v5.1.0 Upgrade & Shopper Baskets V2 - To support SF Payments, Retail React App components have been updated to use Shopper Baskets V2

For more details, see PWA Kit 3.17 Changes in the Composable Storefront Developer Guide.

Package Changes

@salesforce/commerce-sdk-react@5.1.0

• Add Page Designer Support #3727
• Bump commerce-sdk-isomorphic to 5.1.0 #3725
  Update ShopperBasketsV2 hooks documentation and query keys #3728
• Add Node 24 support. Drop Node 16 support. #3652
• Add Shopper Consents API support #3674

@salesforce/retail-react-app@9.1.0

• [Bugfix] Fix edirect payment methods status value to pascal #3734
• [Bugfix] Fix in checkout and cart page: LoadingSpinner to have full screen overlay #3730
• [Bugfix] Fix adding to cart from a master product in the wishlist #3732
• Add Page Designer Support #3727
• [Feature] Add Salesforce Payments support in checkout #3725
• One Click Checkout removed from Developer Preview. When shoppers use passwordless OTP login with one-click checkout, the system saves their shipping and payment information for faster checkout in the future. Security safeguards required: (1) Captcha - Protects the passwordless login from bots. (2) OTP for Email Changes - Verifies identity before an email update, prevents accidental account lockouts from typos, and prevents unauthorized access to saved payment methods.
• Update jest-fetch-mock and Jest 29 dependencies #3663
• Add Node 24 support. Drop Node 16 support #3652
• [Bugfix] Fix error toast for no applicable shipping methods in one-click checkout #3673
• [Feature] Subscribe to marketing communications. Email capture component updated in footer section to use Shopper Consents API. #3674
• [Bugfix] Fix for custom billing address as returning shoppers in 1CC #3693
• [Feature] Add translations for text in 1CC #3703

@salesforce/pwa-kit-runtime@3.17.0

• Add Node 24 support. Migrate deprecated Node.js url.parse() and url.format() to the WHATWG URL #3652

@salesforce/pwa-kit-create-app@3.17.0

• Add Salesforce Payments configuration to generated projects [#3725] (#3725)
• Clear verdaccio npm cache during project generation #3652
• Add Node 24 support, remove legacy url module import. Drop Node 16 support #3652
• One Click Checkout removed from Developer Preview. When shoppers use passwordless OTP login with one-click checkout, the system saves their shipping and payment information for faster checkout in the future. Security safeguards required: (1) Captcha - Protects the passwordless login from bots. (2) OTP for Email Changes - Verifies identity before an email update, prevents accidental account lockouts from typos, and prevents unauthorized access to saved payment methods.
• [Bugfix] Add missing dependency overrides to extensible app package.json template to address console warnings on build #3745

@salesforce/pwa-kit-dev@3.17.0

• Add Page Designer Design CSS Support #3727
• Update jest, archiver and remove rimraf dependencies #3663
• Add Node 24 support, remove legacy url module import. Drop Node 16 support #3652

@salesforce/pwa-kit-react-sdk@3.17.0

• Update test setup for Jest 29 compatibility #3663
• Add Node 24 support. Drop Node 16 support #3652

Highlights

• One Click Checkout (Developer Preview) — Streamlined checkout experience with a single click for returning shoppers
• Commerce SDK Isomorphic v5.0.0 — Introduces Payment Instrument SCAPI integration
• Passwordless Login Enhancements — Email mode is now the default for passwordless login and password reset, with configurable mode across login page, auth modal, and checkout
• PWA Integration with OMS — Order Details, Order History, shipping display, and BOPIS multishipment support
• AWS SDK v2 to v3 Migration — Modernized cloud infrastructure dependency in pwa-kit-runtime

Enabling One Click Checkout (Developer Preview)

One Click Checkout is shipped as a Developer Preview feature and is disabled by default. To enable it, follow these steps:

Prerequisites

One Click Checkout requires a SLAS private client. If your project is not already configured to use a SLAS private client, follow the setup guide first: Use a SLAS Private Client.

1. Enable the feature flag

In your project's config/default.js, set the oneClickCheckout.enabled flag to true:

// config/default.js
app: {
    // ...existing config
    oneClickCheckout: {
        enabled: true
    }
}

2. Configure the SLAS private client proxy

In your project's ssr.js, add the onSLASPrivateProxyRes callback to the runtime options to handle passwordless login responses correctly:

onSLASPrivateProxyRes: (responseBuffer, proxyRes, req, res) => {
    // Undo the 404 → 200 masking for /oauth2/passwordless/login
    if (req.path?.match(/\/oauth2\/passwordless\/login/) && proxyRes.statusCode === 404) {
        res.statusCode = 404
        res.statusMessage = 'Not Found'
    }
    return responseBuffer
},

Developer Preview Disclaimer

This feature is available as a Developer Preview. Developer Preview features aren't generally available unless or until Salesforce announces general availability in documentation, press releases, or public statements. All commands, parameters, and other features are subject to change or deprecation at any time, with or without notice. Don't implement functionality developed with these commands or tools in production environments.

Package Changes

@salesforce/commerce-sdk-react@5.0.0

• Upgrade to commerce-sdk-isomorphic v5.0.0 and introduce Payment Instrument SCAPI integration #3552
• [Bugfix] Ensure code_verifier can be optional in resetPassword call #3567
• [Improvement] Strengthening typescript types on custom endpoint options and fetchOptions types #3589
• [Feature] Update authorizePasswordless, getPasswordResetToken, and resetPassword to support use of email mode #3525

@salesforce/retail-react-app@9.0.0

• [Feature] One Click Checkout (in Developer Preview) #3552
• [Feature] Add fuzzyPathMatching to reduce computational overhead of route generation at time of application load #3530
• [Feature] PWA Integration with OMS
  • Integrate Order Details page to display orders data from OMS #3573
  • Integrate Order History page to display data from OMS #3581
  • Add shipping display support for OMS #3588
  • BOPIS multishipment with OMS #3613
  • Default to ECOM shipments in case OMS has no shipments #3639
• [Feature] Update passwordless login and password reset to use email mode by default. The mode can now be configured across the login page, auth modal, and checkout page #3525
• Update "Continue Securely" button text to "Continue" for passwordless login #3556
• Util function for passwordless callback URI #3630
• Allow shopper to manually input OTP during passwordless login #3554
• [Bugfix] Fix Passwordless Login landingPath, Reset Password landingPath, and Social Login redirectUri value in config not being used #3560
• [BREAKING] Remove unused absoluteUrl util from retail react app #3633

@salesforce/pwa-kit-runtime@3.16.0

• Migrate AWS SDK from v2 to v3 #3566
• Updated the SLAS private client proxy to enable customizing the proxy response body #3662

@salesforce/pwa-kit-create-app@3.16.0

• Add new One-Click Checkout configuration #3609
• Support email mode by default for passwordless login and password reset in a generated app #3525
• Util function for passwordless callback URI #3630
• Add tokenLength to login configuration #3554

@salesforce/pwa-kit-dev@3.16.0

@salesforce/pwa-kit-react-sdk@3.16.0

Highlights

• [#3071] Address Autocompletion feature, powered by Google Maps platform
• [#3071] Commerce SDK Isomorphic upgraded to v4.2.0; introduces support for SCAPI Shopper Configurations API (Included as part of Address Autocomplete)

Bugfixes

• [#3508] Fix multiple set-cookie headers
• [#3493] Fix Forgot Password link not working from Account Profile password update form

Highlights

For release highlights, see PWA Kit 3.14 Changes in the Composable Storefront Developer Guide.

@salesforce/commerce-sdk-react@4.2.0

• Upgrade to commerce-sdk-isomorphic v4.0.1 #3449
• Prevent headers from being overriden in generateCustomEndpointOptions #3405

@salesforce/pwa-kit-create-app@3.14.0

• Prompt text for Site ID should match actual validation: Site ID may contain uppercase or lowercase letters, numbers, hyphens, or underscores. - Updated Site ID validator regex to allow both uppercase and lowercase letters for improved compatibility, clarity. [#3410] (#3410)
• Added Hybrid Proxy support configuration for local and ODS hybrid development [#3409] (#3409)

@salesforce/pwa-kit-dev@3.14.0

@salesforce/pwa-kit-react-sdk@3.14.0

@salesforce/pwa-kit-runtime@3.14.0

• Replace aws-serverless-express with @h4ad/serverless-adapter #3325
• Added Hybrid Proxy support for local and ODS hybrid development [#3409] (#3409)
• Add extensibility hooks for SLAS private client proxy with onSLASPrivateProxyReq and onSLASPrivateProxyRes callbacks #3411

@salesforce/retail-react-app@8.2.0

• Add support for Rule Based Promotions for Choice of Bonus Products. We are currently supporting only one product level rule based promotion per product #3418
• Added Einstein suggestions support for popular and recent searches in search functionality. Users can now see personalized search suggestions based on Einstein AI recommendations. #3422
• [Bugfix] Fix footer heading semantic consistency and alignment. Fix accessibility compliance by adding proper h1 headings to checkout pages to resolve the page-has-heading-one accessibility rule violation. #3398
• [Bugfix] Use serverSafeEncode util for address mutations. #3380
• Added Hybrid Proxy support for local and ODS hybrid development [#3409] (#3409)
• My Account Order Details page correctly shows orders with BOPIS and with Multiple shipments #3414
• Fix bug where pick up items were displaying delivery stock levels instead of in store stock levels #3401
• When registering a guest user on the confirmation page only save the delivery addresses to the new account
  #3412
• Improve mobile layout for StoreDisplay component 3420

Highlights

For release highlights, see PWA Kit 3.13 Changes in the Composable Storefront Developer Guide.

@salesforce/commerce-sdk-react@4.1.0

@salesforce/pwa-kit-create-app@3.13.0

• Enhanced the shopping assistant, Guided Shopping Agent for B2C Storefronts, that integrates Salesforce Embedded Messaging Service with PWA Kit applications. Added comprehensive context support, localization capabilities, and improved user experience features. #3259

@salesforce/pwa-kit-dev@3.13.0

• Excluded opentelemetry packages from client side bundling #3133

@salesforce/pwa-kit-mcp@0.3.0

• Added telemetry for MCP tools. #3327

@salesforce/pwa-kit-react-sdk@3.13.0

• Opentelemetry integration for SSR tracing #3133

@salesforce/pwa-kit-runtime@3.13.0

@salesforce/retail-react-app@8.1.0

• Enhanced search experience - prices, images, suggestions new layout #3271
• Updated the UI for StoreDisplay component which displays pickup in-store information on different pages. #3248
• Added warning modal for guest users when toggling between multiple shipments and shipping to one address. #3280 #3302
• Fixed the invalid address error that could occur when consolidating a pickup shipment into the default shipment me on checkout. #3333
• Enhanced the shopping assistant, Guided Shopping Agent for B2C Storefronts, that integrates Salesforce Embedded Messaging Service with PWA Kit applications. Added comprehensive context support, localization capabilities, and improved user experience features. #3259
• Removed domainUrl, locale, basetId properties as part of the ShopperAgent during initialization. #3259
• Only show option to deliver to multiple addresses if there are multiple items in the basket. #3336
• Added support for Choice of Bonus Products feature. Users can now select from available bonus products when they qualify for the associated promotion. The bonus product selection flow can be entered from either the "Item Added to Cart" modal (when adding the qualifying product to the cart) or from the cart page. [#3292] (#3292)