@salesforce/b2c-dx-mcp 2.1.2 → 3.0.0

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: b2c-ecdn
+description: Manage eCDN zones, security settings, and edge configuration for B2C Commerce storefronts. Use this skill whenever the user needs to purge CDN cache, provision SSL certificates, configure WAF or firewall rules, set up rate limiting, enable logpush or Page Shield, manage MRT routing, configure mTLS or cipher suites, or optimize edge performance. Also use when troubleshooting CDN-layer issues or managing zone settings -- even if they just say 'clear the cache' or 'block bot traffic on our storefront'.
+---
+
+# B2C eCDN Skill
+
+Use the `b2c` CLI plugin to manage eCDN (embedded Content Delivery Network) zones, certificates, security settings, and more.
+
+> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli ecdn zones list`).
+
+## Configuration
+
+Values like `tenantId`, `clientId`, and `clientSecret` resolve from `dw.json` / `SFCC_*` env vars / the active instance / configuration plugins. Examples below show minimal usage; **add flags only to override configured values** — passing `--client-id`/`--client-secret`/`--tenant-id` is usually unnecessary. If a required value is missing, the CLI emits an actionable error pointing at the flag, env var, and config key.
+
+Run `b2c setup inspect` to see the resolved configuration and which source provided each value (`--json` for scripting; secrets stay masked by default). For precedence rules and troubleshooting, see the `b2c-cli:b2c-config` skill.
+
+## Prerequisites
+
+- OAuth credentials with `sfcc.cdn-zones` scope (read operations)
+- OAuth credentials with `sfcc.cdn-zones.rw` scope (write operations)
+- Tenant ID for your B2C Commerce organization (from config or `--tenant-id`)
+
+## Examples
+
+### List CDN Zones
+
+```bash
+# list all CDN zones for the configured tenant
+b2c ecdn zones list
+
+# JSON output
+b2c ecdn zones list --json
+
+# target a different tenant than the active config
+b2c ecdn zones list --tenant-id zzxy_prd
+```
+
+### Create a Storefront Zone
+
+```bash
+# create a new storefront zone
+b2c ecdn zones create --domain-name example.com
+```
+
+### Purge Cache
+
+```bash
+# purge cache for specific paths
+b2c ecdn cache purge --zone my-zone --path /products --path /categories
+
+# purge by cache tags
+b2c ecdn cache purge --zone my-zone --tag product-123 --tag category-456
+```
+
+### Manage Certificates
+
+```bash
+# list certificates for a zone
+b2c ecdn certificates list --zone my-zone
+
+# add a new certificate
+b2c ecdn certificates add --zone my-zone --hostname www.example.com --certificate-file ./cert.pem --private-key-file ./key.pem
+
+# validate a custom hostname
+b2c ecdn certificates validate --zone my-zone --certificate-id abc123
+```
+
+### Manage Rate Limiting Rules
+
+```bash
+# list rate limiting rules
+b2c ecdn rate-limit list --zone my-zone
+
+# create a rate limiting rule
+b2c ecdn rate-limit create --zone my-zone --description "Rate limit /checkout" --expression '(http.request.uri.path matches "^/checkout")' --characteristics cf.unique_visitor_id --action block --period 60 --requests-per-period 50 --mitigation-timeout 600
+
+# get a rule
+b2c ecdn rate-limit get --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e
+
+# update a rule
+b2c ecdn rate-limit update --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --requests-per-period 100
+
+# delete a rule
+b2c ecdn rate-limit delete --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --force
+```
+
+### Security Settings
+
+```bash
+# get security settings
+b2c ecdn security get --zone my-zone
+
+# update security settings
+b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --always-use-https
+```
+
+### Speed Settings
+
+```bash
+# get speed optimization settings
+b2c ecdn speed get --zone my-zone
+
+# update speed settings
+b2c ecdn speed update --zone my-zone --browser-cache-ttl 14400 --auto-minify-html --auto-minify-css
+```
+
+## Additional Topics
+
+For less commonly used eCDN features, see the reference files:
+
+- **[SECURITY.md](references/SECURITY.md)** — WAF (v1 and v2), custom firewall rules, rate limiting, and Page Shield (CSP policies, script detection, notification webhooks)
+- **[ADVANCED.md](references/ADVANCED.md)** — Logpush jobs, MRT routing rules, mTLS certificates, cipher suite configuration, and origin header modification
+
+## Configuration Overrides
+
+The tenant ID can be overridden via flag or environment variable:
+
+- `--tenant-id` / `SFCC_TENANT_ID` / `tenantId` in dw.json
+
+The `--zone` flag accepts either:
+
+- Zone ID (32-character hex string)
+- Zone name (human-readable, case-insensitive lookup)
+
+### OAuth Scopes
+
+| Operation        | Required Scope      |
+| ---------------- | ------------------- |
+| Read operations  | `sfcc.cdn-zones`    |
+| Write operations | `sfcc.cdn-zones.rw` |
+
+### More Commands
+
+See `b2c ecdn --help` for a full list of available commands and options in the `ecdn` topic.

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/evals/trigger-evals.json

@@ -0,0 +1,12 @@
+[
+  {"query": "I need to purge the CDN cache for our storefront after a big product data update. How do I clear it for just the production zone?", "should_trigger": true},
+  {"query": "How do I add a custom SSL certificate to our eCDN zone? We have the cert and key PEM files ready to upload.", "should_trigger": true},
+  {"query": "We're getting hit by bots on our storefront. How do I set up WAF rules and rate limiting on the CDN to block them?", "should_trigger": true},
+  {"query": "I need to set up logpush so our CDN access logs go to our S3 bucket for analysis. How do I configure that?", "should_trigger": true},
+  {"query": "How do I configure MRT routing rules on the eCDN zone to route specific paths to our headless application?", "should_trigger": true},
+  {"query": "I want to enable Page Shield on our storefront zone to monitor third-party scripts and detect potential supply chain attacks.", "should_trigger": true},
+  {"query": "How do I configure a standalone Cloudflare CDN in front of my Node.js Express application?", "should_trigger": false},
+  {"query": "I need to set Cache-Control headers in my B2C controller response so the browser caches product pages for one hour.", "should_trigger": false},
+  {"query": "How do I deploy cartridges to my sandbox and activate the code version?", "should_trigger": false},
+  {"query": "I want to configure a reverse proxy with nginx to sit in front of my Commerce Cloud instance.", "should_trigger": false}
+]

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/references/ADVANCED.md

@@ -0,0 +1,82 @@
+# eCDN Advanced Reference
+
+Logpush, MRT rules, mTLS, cipher suites, and origin header commands for B2C eCDN.
+
+> `tenantId` resolves from `dw.json` / `SFCC_TENANT_ID`. Add `--tenant-id` only to override the active config.
+
+## Logpush
+
+```bash
+# create ownership challenge for S3 destination
+b2c ecdn logpush ownership --zone my-zone --destination-path 's3://my-bucket/logs?region=us-east-1'
+
+# list logpush jobs
+b2c ecdn logpush jobs list --zone my-zone
+
+# create a logpush job
+b2c ecdn logpush jobs create --zone my-zone --name "HTTP logs" --destination-path 's3://my-bucket/logs?region=us-east-1' --log-type http_requests
+
+# update a logpush job (enable/disable)
+b2c ecdn logpush jobs update --zone my-zone --job-id 123456 --enabled
+
+# delete a logpush job
+b2c ecdn logpush jobs delete --zone my-zone --job-id 123456
+```
+
+## MRT Rules
+
+```bash
+# get MRT ruleset for a zone
+b2c ecdn mrt-rules get --zone my-zone
+
+# create MRT rules to route to a Managed Runtime environment
+b2c ecdn mrt-rules create --zone my-zone --mrt-hostname customer-pwa.mobify-storefront.com --expressions '(http.host eq "example.com")'
+
+# update MRT ruleset hostname
+b2c ecdn mrt-rules update --zone my-zone --mrt-hostname new-customer-pwa.mobify-storefront.com
+
+# delete MRT ruleset
+b2c ecdn mrt-rules delete --zone my-zone
+```
+
+## mTLS Certificates
+
+```bash
+# list mTLS certificates (organization level)
+b2c ecdn mtls list
+
+# create mTLS certificate for code upload authentication
+b2c ecdn mtls create --name "Build Server" --ca-certificate-file ./ca.pem --leaf-certificate-file ./leaf.pem
+
+# get mTLS certificate details
+b2c ecdn mtls get --certificate-id abc123
+
+# delete mTLS certificate
+b2c ecdn mtls delete --certificate-id abc123
+```
+
+## Cipher Suites
+
+```bash
+# get cipher suites configuration
+b2c ecdn cipher-suites get --zone my-zone
+
+# update to Modern cipher suite
+b2c ecdn cipher-suites update --zone my-zone --suite-type Modern
+
+# update to Custom cipher suite with specific ciphers
+b2c ecdn cipher-suites update --zone my-zone --suite-type Custom --ciphers "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256"
+```
+
+## Origin Headers
+
+```bash
+# get origin header modification
+b2c ecdn origin-headers get --zone my-zone
+
+# set origin header modification (for MRT)
+b2c ecdn origin-headers set --zone my-zone --header-value my-secret-value
+
+# delete origin header modification
+b2c ecdn origin-headers delete --zone my-zone
+```

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/references/SECURITY.md

@@ -0,0 +1,75 @@
+# eCDN Security Reference
+
+WAF, firewall rules, rate limiting, and Page Shield commands for B2C eCDN.
+
+> `tenantId` resolves from `dw.json` / `SFCC_TENANT_ID`. Add `--tenant-id` only to override the active config.
+
+## WAF (Web Application Firewall)
+
+```bash
+# list WAF v1 groups
+b2c ecdn waf groups list --zone my-zone
+
+# update WAF v1 group mode
+b2c ecdn waf groups update --zone my-zone --group-id abc123 --mode on
+
+# list WAF v1 rules in a group
+b2c ecdn waf rules list --zone my-zone --group-id abc123
+
+# list WAF v2 rulesets
+b2c ecdn waf rulesets list --zone my-zone
+
+# update WAF v2 ruleset
+b2c ecdn waf rulesets update --zone my-zone --ruleset-id abc123 --action block
+
+# migrate zone to WAF v2
+b2c ecdn waf migrate --zone my-zone
+```
+
+## Firewall Rules
+
+```bash
+# list custom firewall rules
+b2c ecdn firewall list --zone my-zone
+
+# create a firewall rule
+b2c ecdn firewall create --zone my-zone --description "Block bad bots" --action block --filter '(cf.client.bot)'
+
+# update a firewall rule
+b2c ecdn firewall update --zone my-zone --rule-id abc123 --action challenge
+
+# reorder firewall rules
+b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3
+```
+
+## Rate Limiting
+
+```bash
+# list rate limiting rules
+b2c ecdn rate-limit list --zone my-zone
+
+# create a rate limiting rule
+b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --threshold 100 --period 60 --action block --match-url '/api/*'
+
+# delete a rate limiting rule
+b2c ecdn rate-limit delete --zone my-zone --rule-id abc123
+```
+
+## Page Shield
+
+```bash
+# list Page Shield notification webhooks (organization level)
+b2c ecdn page-shield notifications list
+
+# create a notification webhook
+b2c ecdn page-shield notifications create --url https://example.com/webhook --secret my-secret --zones zone1,zone2
+
+# list Page Shield policies (zone level)
+b2c ecdn page-shield policies list --zone my-zone
+
+# create a CSP policy
+b2c ecdn page-shield policies create --zone my-zone --action allow --value script-src
+
+# list detected scripts
+b2c ecdn page-shield scripts list --zone my-zone
+```

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-import-set-migrations/SKILL.md

@@ -0,0 +1,265 @@
+---
+name: b2c-import-set-migrations
+description: Create and apply ordered, idempotent B2C Commerce site import/export archives from discovered cartridge metadata and project migrations using `b2c job import-set`. Use this opt-in project workflow for migrations built from focused instance exports, repeatable setup, onboarding, and CI/CD imports that apply once per instance. Also covers source exclusions, post-import README notes, resetting history, and recovering an interrupted run.
+---
+
+# Import Set Migrations Skill
+
+Use `b2c job import-set` to apply site import/export archives from discovered cartridge `metadata/` directories followed by project migrations. Each archive is applied once per instance and skipped on later runs. Re-running the command is the intended workflow for local setup, developer onboarding, and CI/CD.
+
+> [!IMPORTANT]
+> **This is an optional, opt-in, project-level approach — not a default workflow.** A project adopts it deliberately by keeping import-set sources with its code and running `b2c job import-set` from setup scripts or CI. Follow an existing project's conventions. If a project only uses occasional one-off site imports, use the `b2c-cli:b2c-site-import-export` skill instead.
+
+> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli job import-set`).
+
+## Configuration & Authentication
+
+The CLI auto-discovers the target instance and credentials from `SFCC_*` environment variables (including project `.env`), the selected project-local or shared `dw.json`, and configuration plugins. `package.json` supplies only non-sensitive defaults. **Flags like `--server`, `--client-id`, `--client-secret`, `--username`, and `--password` are usually unnecessary** — only pass them to override what's auto-detected.
+
+`job import-set` requires both OAuth and WebDAV credentials. Run `b2c setup inspect` to confirm the resolved configuration; see the `b2c-cli:b2c-config` skill for precedence rules and troubleshooting.
+
+## Import Sources and Order
+
+The command considers cartridge metadata first, followed by the project migrations directory (`./migrations` by default). Discovered cartridges are ordered by name, and archives within each source are ordered lexically.
+
+A cartridge `metadata/` directory can use either layout:
+
+- If it resembles a standard site import/export archive, the entire `metadata/` directory is one archive.
+- Otherwise, each immediate child directory or `.zip` file is one archive, matching the migrations-directory behavior.
+
+Keep each cartridge in one form rather than mixing an archive layout with ordered children. Directory-based archives must contain at least one file.
+
+The project migrations directory contains immediate child directories and `.zip` files as archives. Hidden entries and other loose files are ignored:
+
+```text
+migrations/
+├── 20260801T140000-add-preferences/
+│   ├── README.md                   # post-import note for THIS archive (see below)
+│   ├── meta/
+│   │   └── system-objecttype-extensions.xml
+│   └── sites/
+│       └── RefArch/
+│           └── preferences.xml
+├── 20260802T091500-seed-content.zip
+└── README.md                       # top-level README is not an archive
+```
+
+Each archive directory (or the contents of each zip) uses the standard site import/export archive layout that `b2c job import` accepts. For archive structure and metadata XML patterns, see the `b2c-cli:b2c-site-import-export` skill.
+
+### Naming convention
+
+Name every ordered child archive `YYYYMMDDTHHmmss-description`, e.g. `20260801T140000-add-preferences`. Use UTC so ordering is stable across time zones. Names identify applied archives, so never edit or reuse a name after it has been applied; add a new, later-sorting archive instead.
+
+## Commands
+
+```bash
+# Preview: show pending vs. already-applied archives; writes nothing to the instance
+b2c job import-set --dry-run
+
+# Apply the default ./migrations directory (safe to repeat)
+b2c job import-set
+
+# Apply a different directory
+b2c job import-set ./data-migrations
+
+# Import project migrations without discovered cartridge metadata
+b2c job import-set --no-cartridge-metadata
+
+# Exclude project-relative source trees recursively
+b2c job import-set --import-set-exclude fixtures --import-set-exclude test/integration
+
+# Keep each uploaded archive on the instance after import (for inspection)
+b2c job import-set --keep-archive
+```
+
+### Flags
+
+| Flag                        | Description                                                                        | Default      |
+| --------------------------- | ---------------------------------------------------------------------------------- | ------------ |
+| `--dry-run`                 | Show pending and applied archives without locking, importing, or writing state     | `false`      |
+| `--keep-archive`, `-k`      | Keep each uploaded archive on the instance after import                            | `false`      |
+| `--[no-]cartridge-metadata` | Include imports from discovered cartridge `metadata/` directories                  | `true`       |
+| `--import-set-exclude`      | Exclude a project-relative directory recursively from source discovery; repeatable |              |
+| `--set-id`                  | Name an independent import history                                                 | `migrations` |
+| `--break-lock`              | Recover an interrupted import-set run immediately                                  | `false`      |
+| `--stale-lock-seconds`      | Consider an inactive import-set run recoverable after this many seconds            | `1800`       |
+| `--lock-poll-interval`      | Seconds between checks while waiting for another run                               | `3`          |
+| `--timeout`, `-t`           | Timeout in seconds for each individual import job                                  | No timeout   |
+| `--poll-interval`           | Job polling interval in seconds                                                    | `3`          |
+| `--show-log`                | Show the job log when an import fails                                              | `true`       |
+| `--json`                    | Emit machine-readable archive statuses and counts; suppress human output           | `false`      |
+
+### Source exclusions
+
+`--import-set-exclude` accepts repeated flags or comma-separated paths. Paths are relative to `--project-directory` or the current project and exclude the directory and all descendants from source discovery. The setting is also available as:
+
+- `import-set-exclude` in `dw.json`
+- `b2c.importSetExclude` in `package.json`, which is suitable for committed project defaults
+- comma-separated `SFCC_IMPORT_SET_EXCLUDE`
+
+Exclusions select source directories; they do not remove files from inside a selected archive.
+
+## Post-Import Notes (per-archive README)
+
+Some migrations require **manual follow-up** that cannot be captured in an archive — for example enabling an instance-specific site preference, wiring a service credential in Business Manager, or flipping a feature toggle after the data lands.
+
+Document these in a `README.md` (or `README`) file at the top of a directory-based archive, whether it comes from cartridge metadata or project migrations. After a run, the CLI prints the notes for archives it applied in a consolidated **Post-import notes** summary.
+
+```text
+migrations/
+└── 20260801T140000-add-preferences/
+    ├── README.md
+    ├── meta/
+    └── sites/
+```
+
+**`20260801T140000-add-preferences/README.md`:**
+
+```markdown
+# Add feature-X preferences
+
+Manual follow-up (per instance):
+
+1. In Business Manager, go to Merchant Tools > Site Preferences > Feature X.
+2. Set the API endpoint to the instance-specific value (not imported — differs per environment).
+3. Save and verify the storefront picks it up.
+```
+
+Behavior:
+
+- Notes are surfaced only for archives **applied in this run** (freshly imported). Archives already applied on the instance (skipped) do not repeat their notes, so the summary reflects only what just changed.
+- `--dry-run` shows the notes for **pending** archives as a preview, so you can review manual steps before committing to the import.
+- Only directory-based archives are scanned for a README; `.zip` archives are not. `README.md` takes precedence over `README`. An empty README produces no note.
+- The top-level README of the set directory itself is not an archive and is not printed — use it for human-facing docs about the set as a whole.
+- With `--json`, notes are not printed; each archive's note text is available in the JSON result instead.
+
+This is the idiomatic place to record "what a human must still do" for a migration — keep archive contents safe to reapply and push environment-specific manual work into the note.
+
+## Repeat Runs
+
+After each successful import, the target instance records that archive's name. Later runs skip it without comparing contents.
+
+Key rules:
+
+- An interrupted run can retry its current archive, so every archive must be safe to apply more than once.
+- Applied state is shared across developers, checkouts, and CI runners targeting the same instance.
+- Never edit an applied archive. Add a new, later-sorting archive for every change.
+- Keep names distinct within an import history; UTC timestamps make collisions unlikely.
+
+## Set IDs (namespaces)
+
+The default import history is named `migrations` and is shared by runs against the same instance, regardless of local directory path.
+
+Most projects should **omit `--set-id`**. Use it only to intentionally maintain an independent migration history on the same instance, or to preserve a legacy namespace whose archive names cannot follow the timestamp convention.
+
+## Concurrent Runs and Recovery
+
+Only one runner applies a given history at a time. Other runners wait and then skip archives completed while they were waiting.
+
+An interrupted run becomes recoverable after 30 minutes by default; tune this with `--stale-lock-seconds`. Use `--break-lock` when it must be recovered immediately.
+
+## Idiomatic Workflows
+
+### Local setup / onboarding
+
+Commit the cartridge metadata and/or `./migrations` sources to the repo. New developers point the CLI at their sandbox and run:
+
+```bash
+b2c job import-set --dry-run   # see what will apply
+b2c job import-set             # apply; read the post-import notes for manual steps
+```
+
+Running it again later applies only the migrations added since.
+
+### CI/CD
+
+Run `b2c job import-set` as a deploy step against staging/production. It is safe to run on every pipeline invocation — only unapplied archives import. Prefer `--json` to capture the applied/skipped counts and per-archive note text for logs or downstream summaries:
+
+```bash
+b2c job import-set --json > import-set-result.json
+```
+
+Concurrent pipeline runs coordinate automatically.
+
+### Adding a new migration
+
+1. Reserve a new name with the current UTC timestamp: `20260815T120000-add-loyalty-attrs/`.
+2. For hand-authored data, create that directory and put the site archive contents inside (`meta/`, `sites/`, etc.). For instance-owned data, use the direct export workflow below.
+3. If manual follow-up is needed, add a `README.md` describing it.
+4. Run `b2c job import-set --dry-run`, review the pending archive, and commit. The next apply run imports only unapplied archives.
+
+### Building a migration from an instance export
+
+When the desired state already exists on an instance, export it instead of reconstructing XML from memory. Load these related skills before acting:
+
+- `b2c-cli:b2c-config` to confirm the source instance.
+- `b2c-cli:b2c-job` for export data units and `--output` behavior.
+- `b2c-cli:b2c-site-import-export` for archive layout, XML patterns, and schema-valid trimming.
+- `b2c-cli:b2c-content` for selected Page Designer pages, components, content blocks, and assets.
+- `b2c:b2c-metadata` when editing system attributes, custom object definitions, or site preferences.
+
+Export directly into the import-set source tree and edit the resulting archive in place. A temporary review directory followed by a copy is optional, not the default.
+
+`b2c job export --output migrations` extracts the platform archive under a newly generated `*_export` directory. Rename that one new directory immediately to the reserved permanent migration name, before previewing or applying the import set:
+
+```bash
+b2c setup inspect -i <SOURCE_INSTANCE>
+
+# Site descriptor, including a site's cartridge path
+b2c job export \
+  --site <SITE_ID> \
+  --site-data site_descriptor \
+  --output migrations \
+  -i <SOURCE_INSTANCE>
+
+# Other focused examples
+b2c job export --site <SITE_ID> --site-data site_preferences --output migrations -i <SOURCE_INSTANCE>
+b2c job export --global-data meta_data --output migrations -i <SOURCE_INSTANCE>
+b2c job export --library <LIBRARY_ID> --output migrations -i <SOURCE_INSTANCE>
+
+# Rename the one newly generated archive root once, then edit it in place.
+mv migrations/<GENERATED_EXPORT_DIR> migrations/<YYYYMMDDTHHmmss>-<description>
+```
+
+For selected Page Designer/content items, preview the match set and point the focused exporter directly at the final migration directory; it writes archive-relative `libraries/` or site-library content without a generated wrapper:
+
+```bash
+b2c content export <CONTENT_ID> --library <LIBRARY_ID> --dry-run --show-tree -i <SOURCE_INSTANCE>
+b2c content export <CONTENT_ID> \
+  --library <LIBRARY_ID> \
+  --output migrations/<YYYYMMDDTHHmmss>-<description> \
+  -i <SOURCE_INSTANCE>
+```
+
+Add `--site-library` for a site-private library. After any export, inspect every file and remove unrelated data, generated `version.txt`, environment-specific values, and secrets—including encrypted or hashed password values. Preserve the standard archive-relative layout and keep schema-required companion fields; validate trimmed XML against the matching B2C XSD rather than assuming a partial document is valid.
+
+Never export over an existing or applied archive. Use a temporary directory only intentionally, such as when comparing multiple exploratory exports or when a tool cannot isolate a new archive safely under the import-set directory.
+
+## Resetting Import History
+
+There is no dedicated reset command. Prefer starting a separate history so the old one remains intact:
+
+```bash
+b2c job import-set --set-id migrations-reset-20260818
+```
+
+Continue using that set ID on future runs. To clear the default history in place instead, remove it through WebDAV and rerun:
+
+```bash
+b2c webdav rm --root=impex b2c-cli/import-sets/migrations
+b2c job import-set
+```
+
+For a custom set ID, replace the final path segment. Clearing history makes every current archive pending again, so use it only when all archives are safe to reapply. `--break-lock` recovers an interrupted run; it does not reset history.
+
+## Import Failure Recovery
+
+Fix the archive or target-instance problem and rerun. Archives already applied are skipped, and the failed archive retries. `--show-log` is enabled by default and displays the platform job log for a failed import.
+
+## Related Skills
+
+- `b2c-cli:b2c-site-import-export` - Single archive import/export, site-archive folder structure, and metadata XML patterns
+- `b2c-cli:b2c-job` - Running and monitoring jobs, including individual archive imports and `job search`/`job wait`
+- `b2c:b2c-metadata` - System object extensions, custom object definitions, and site preferences
+- `b2c-cli:b2c-webdav` - Clearing an import history when an in-place reset is required
+- `b2c-cli:b2c-config` - Resolving instance and credential configuration

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-import-set-migrations/evals/trigger-evals.json

@@ -0,0 +1,12 @@
+[
+  {"query": "We keep a ./migrations folder in the repo with timestamped site archives. How do I apply the ones that haven't run yet on my sandbox and skip the ones already imported?", "should_trigger": true},
+  {"query": "I want site imports to work like database migrations — an ordered set of archives that apply once per instance, in order, and are safe to re-run in CI without reimporting what's already applied.", "should_trigger": true},
+  {"query": "Our onboarding has ten metadata and content archives that must import in a fixed order, and new hires re-run them all the time. What's the idempotent way to do this with the CLI?", "should_trigger": true},
+  {"query": "Some of our migrations need a manual step afterward, like flipping a site preference in Business Manager per environment. Is there a way to document that so it shows up when the import runs?", "should_trigger": true},
+  {"query": "A CI runner crashed partway through applying our import set and now the lock seems stuck. How do I recover and re-run so it retries only the unapplied archives?", "should_trigger": true},
+  {"query": "How do I preview which archives in my migrations directory are pending versus already applied before I actually run the imports?", "should_trigger": true},
+  {"query": "I have a single site archive zip and I just need to import it to my sandbox once and wait for it to finish. What's the command?", "should_trigger": false},
+  {"query": "I need to export the full site configuration from staging as XML so I can diff it against production.", "should_trigger": false},
+  {"query": "How do I push my updated cartridge code to the sandbox so my controller changes take effect?", "should_trigger": false},
+  {"query": "The product search index looks stale after a data feed update. How do I trigger a reindex job and confirm it completed?", "should_trigger": false}
+]

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-job/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: b2c-job
+description: Run existing B2C Commerce jobs, monitor executions, inspect failures, rebuild search indexes, and import or export site archives with the CLI.
+---
+
+# Run and Monitor Jobs
+
+Use `b2c job` for existing jobs. To create job steps or author `jobs.xml`, use
+`b2c:b2c-custom-job-steps`. If `b2c` is unavailable, use `npx @salesforce/b2c-cli`.
+
+## Configuration and tool choice
+
+CLI and MCP share configuration: `SFCC_*` variables (including project `.env`),
+project/shared `dw.json`, and plugins; `package.json` provides nonsecret defaults.
+Use `--project-directory` when running outside the target project. Inspect with
+`b2c setup inspect --json` or MCP `config_inspect`; both mask secrets by default.
+Override configured values only when needed. For resolution issues, use `b2c-cli:b2c-config`.
+
+No dedicated MCP job tool exists. Prefer these CLI workflows for running/waiting
+on jobs and transferring archives. MCP `scapi_search`/`scapi_execute` can compose
+supported Admin requests; they do not replace the CLI's archive transfer workflow.
+
+## Run and inspect
+
+```bash
+b2c job run my-job --wait --timeout 600
+b2c job run my-job --wait -P key=value
+b2c job search --job-id my-job --count 5
+b2c job wait my-job execution-id --timeout 600
+b2c job log my-job --failed
+```
+
+`job run` returns immediately unless `--wait` is supplied. For raw system-job
+bodies, search indexing, standard step choices, execution deletion, and backend
+configuration: [run and monitor](references/RUN-AND-MONITOR.md).
+Deletion removes completed execution records; it does not cancel jobs.
+
+## Site archives
+
+```bash
+b2c job import ./archive --show-log
+b2c job export --site MySite --site-data campaigns_and_promotions --output ./export
+```
+
+Import/export wait by default and transfer files over WebDAV. Jobs prefer SCAPI
+(`sfcc.jobs.rw` for writes, `sfcc.jobs` for reads); `--api-backend auto` falls back
+on supported SCAPI rejections. See the backend section in the run/monitor reference
+if access fails. Check job outcome before retrying a write.
+
+Read only the relevant reference:
+
+- Import remote archives or directory subsets: [import options](references/IMPORT.md).
+- Choose export data units or output paths: [export](references/EXPORT.md).
+- Author/validate XML and verify imported settings: `b2c-cli:b2c-site-import-export`.
+- Apply ordered, tracked migrations: `b2c-cli:b2c-import-set-migrations`.
+
+## Output
+
+Normal CLI output suffices for status. For scripting, save large `--json` results
+to a file and print selected fields; keep the exit code and inspect failures.
+See [export](references/EXPORT.md), section `compact-results`. Avoid dumping full
+execution records or reading both JSON and human output for the same result.

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-job/evals/trigger-evals.json

@@ -0,0 +1,12 @@
+[
+  {"query": "The product search on our sandbox isn't returning newly added products. I think the search index is stale and needs a rebuild. How do I trigger that?", "should_trigger": true},
+  {"query": "I have a site archive zip ready and I need to run the import job on my sandbox and wait for it to complete. What's the CLI command and how do I check if it succeeded?", "should_trigger": true},
+  {"query": "The nightly product export job keeps failing on our sandbox and I can't figure out why from Business Manager. Is there a way to run it and see the detailed logs?", "should_trigger": true},
+  {"query": "I just updated a bunch of product descriptions via a data feed and now I need to make sure the search index picks them up before our QA team tests tomorrow morning. How do I kick off a reindex and confirm it completed?", "should_trigger": true},
+  {"query": "I need to trigger a site export job on my instance and then download the resulting archive. How do I run the export and get the output files?", "should_trigger": true},
+  {"query": "We have a scheduled import that runs at 2am but it seems to be stuck in a running state for over 3 hours. I need to check what's happening with it — is there a way to see the execution status and logs for currently running processes on the instance?", "should_trigger": true},
+  {"query": "I need to write a batch processing script that runs nightly to clean up expired promotions. What's the job step pattern?", "should_trigger": false},
+  {"query": "How do I set up a cron job on our CI server to automatically run our test suite every night?", "should_trigger": false},
+  {"query": "I need to deploy my updated cartridge code to the sandbox so the new controller changes take effect. What's the push command?", "should_trigger": false},
+  {"query": "I'm writing a custom chunk-oriented step module in my cartridge — where do I put the read/process/write functions and how does the steptypes.json definition work?", "should_trigger": false}
+]