feat: add app_pwakit_base B2C cartridge for transactional email delivery

docs/hybrid-cookie-domain-configuration.md

@@ -1,7 +1,7 @@
 # Hybrid Cookie Domain Configuration
 
 > **WIP: HttpOnly session cookies are in-progress. Do not enable `enableHttpOnlySessionCookies` in production.**
- 
+
 Maintain shopper sessions across subdomains by configuring a shared parent cookie domain. Without this configuration, browsers isolate cookies to individual hosts, causing shoppers to appear logged out and lose their baskets when crossing subdomain boundaries. The domain-level cookie applies to storefronts that use multiple subdomains, such as `www.` and `shop.` on the `example.com` domain. It also applies to hybrid PWA Kit and SFRA storefronts that serve different paths under one parent domain. This guide shows how to align the cookie domain settings on both PWA Kit and B2C Commerce to enable seamless cross-subdomain navigation.
 
 ## Overview

packages/pwa-kit-create-app/CHANGELOG.md

@@ -1,5 +1,6 @@
 ## v3.21.0 (Oct 08, 2026)
 - [Bugfix] Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app` for Commerce Client image upload (`cc_enableImageUpload`): add `blob:` and `data:` to `img-src` in both SSR template variants so the widget's image preview and sent-image thumbnail are not blocked by CSP in generated projects. [#4053](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4053)
+- Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app`: fix GLO endpoints to read the SLAS access token from `req.headers.authorization` (sent by the client via `useAccessToken().getTokenWhenReady()`) instead of the `cc-at_*` cookie, which is never written in standard SLAS setups. Remove the unused `parseCookieValue` helper. Add public-client fallback for `pwakit-notify` token acquisition: use `loginGuestUserPrivate` when `PWA_KIT_SLAS_CLIENT_SECRET` is set, otherwise fall back to `loginGuestUser` (PKCE guest flow) so notification delivery works without a private SLAS client. [#4012](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4012)
 - Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app` for the `dw_attribution` first-touch marketing-attribution cookie (W-23493129): both SSR template variants now import `createAttributionCookieMiddleware`, construct it with the configured `cookieDomain`, and mount it on the catch-all render route, so generated projects write the attribution cookie instead of shipping the utility as dead code.
 - Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app` for Guest Order Lookup (GLO): add all `/api/order-lookup/*` Express route handlers (verify, order, oms-meta, cancel, return), helper functions (`makeShopperOrders`, `filterGuestOrderFields`, `parseGuestOrderCookie`, `evictIfNeeded`, `createVerifyThrottle`), and the `commerce-sdk-isomorphic` `ShopperOrders` import so generated projects compile and run the feature when `guestOrderLookup.enabled` is set to `true`. [#3982](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3982)
 - Keep the generated Commerce Client auth-link templates in sync with `template-retail-react-app`: the browser reads the deployment-scoped `cim_af_ct_<orgId>_<embeddedServiceName>` storage value and calls SCRT2's `/iamessage/api/v2/authorization/authlink` endpoint directly with the Commerce Client JWT to obtain an `auth_link_key` for Token Bridge use. The generated `ssr.js.hbs` no longer registers a `/api/agent/authlink` proxy route. [#3981](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3981)

packages/pwa-kit-create-app/assets/bootstrap/js/config/default.js.hbs

@@ -84,12 +84,12 @@ module.exports = {
                 {{else}}
                 enabled: false,
                 {{/if}}
-                // The mode for passwordless login. Valid values include 'email|callback'. Defaults to: 'callback'
-                mode: 'email',
+                // The mode for passwordless login. Valid values include 'email|callback'. Defaults to: 'email'
+                mode: 'callback',
                 // The callback URI, which can be an absolute URL (including third-party URIs) or a relative path set up by the developer.
                 // Required when mode is set to 'callback'. If the env var `PASSWORDLESS_LOGIN_CALLBACK_URI` is set, it will override the config value.
-                // callbackURI:
-                //     process.env.PASSWORDLESS_LOGIN_CALLBACK_URI || '/passwordless-login-callback',
+                callbackURI:
+                    process.env.PASSWORDLESS_LOGIN_CALLBACK_URI || '/passwordless-login-callback',
                 // The landing path for passwordless login
                 landingPath: '/passwordless-login-landing'
             },
@@ -109,13 +109,18 @@ module.exports = {
                 redirectURI: process.env.SOCIAL_LOGIN_REDIRECT_URI || '/social-callback'
             },
             resetPassword: {
-                // The mode for reset password. Valid values include 'email|callback'. Defaults to: 'callback'
-                mode: 'email',
+                // The mode for reset password. Valid values include 'email|callback'. Defaults to: 'email'
+                mode: 'callback',
                 // The callback URI, which can be an absolute URL (including third-party URIs) or a relative path set up by the developer.
                 // Required when mode is set to 'callback'. If the env var `RESET_PASSWORD_CALLBACK_URI` is set, it will override the config value.
-                // callbackURI: process.env.RESET_PASSWORD_CALLBACK_URI || '/reset-password-callback',
+                callbackURI: process.env.RESET_PASSWORD_CALLBACK_URI || '/reset-password-callback',
                 // The landing path for reset password
                 landingPath: '/reset-password-landing'
+            },
+            registrationVerification: {
+                callbackURI:
+                    process.env.REGISTRATION_VERIFICATION_CALLBACK_URI ||
+                    '/registration-verification-callback'
             }
         },
         // The default site for your app. This value will be used when a siteRef could not be determined from the url
@@ -139,6 +144,7 @@ module.exports = {
             proxyPath: '/mobify/proxy/api',
             parameters: {
                 clientId: '{{answers.project.commerce.clientId}}',
+                notifyClientId: '',
                 organizationId: '{{answers.project.commerce.organizationId}}',
                 shortCode: '{{answers.project.commerce.shortCode}}',
                 siteId: '{{answers.project.commerce.siteId}}'