@salesforce/b2c-dx-mcp 2.1.2 → 3.0.0

package/content/guidance/b2c-cli/b2c-am/SKILL.md

@@ -0,0 +1,277 @@
+---
+name: b2c-am
+description: Manage Account Manager resources including API clients, users, roles, and organizations. Use this skill whenever the user needs to create or update API clients, onboard or offboard developers, assign Account Manager roles scoped to tenants, audit user permissions, look up organizations, or provision API clients for CI/CD pipelines. Also use when managing AM role assignments or querying Account Manager data — even if they just say "add a new developer" or "set up an API client". For instance-level Business Manager administration (BM roles, BM users, BM access keys, BM whoami), defer to the `b2c-cli:b2c-bm-users-roles` skill.
+---
+
+# B2C Account Manager Skill
+
+Use the `b2c am` commands to manage Account Manager resources: API clients, users, roles, and organizations.
+
+> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli am clients list`).
+
+## Authentication
+
+Account Manager commands work out of the box with no configuration. The CLI uses a built-in public client and opens a browser for login.
+
+- **Zero-config (browser login):** Default. Just run the commands -- the CLI opens a browser for login.
+- **Client credentials:** For CI/CD and automation. The CLI auto-discovers `clientId`/`clientSecret` from `SFCC_*` env vars (including project `.env`), the selected project-local or shared `dw.json`, or configuration plugins — **passing `--client-id`/`--client-secret` flags is usually unnecessary**.
+- **Force browser login (`--user-auth`):** When client credentials are configured but you need browser-based login (required for org and client management).
+
+> Run `b2c setup inspect` to confirm which credentials the CLI sees and where they came from. For precedence and troubleshooting, see the `b2c-cli:b2c-config` skill.
+
+### Role Requirements
+
+| Operations       | Client Credentials (roles on API client) | User Auth (roles on user account)           |
+| ---------------- | ---------------------------------------- | ------------------------------------------- |
+| AM Users & Roles | User Administrator                       | Account Administrator or User Administrator |
+| AM Organizations | Not supported -- use `--user-auth`       | Account Administrator                       |
+| AM API Clients   | Not supported -- use `--user-auth`       | Account Administrator or API Administrator  |
+
+Organization and API client management are only available with user authentication. For Business Manager administration (BM roles, users, access keys, whoami), see the `b2c-cli:b2c-bm-users-roles` skill.
+
+## API Clients
+
+### List Clients
+
+```bash
+b2c am clients list
+
+# with pagination
+b2c am clients list --size 50 --page 2
+
+# JSON output
+b2c am clients list --json
+```
+
+### Get Client
+
+```bash
+# by UUID
+b2c am clients get <api-client-id>
+
+# with expanded organizations and roles
+b2c am clients get <api-client-id> --expand organizations,roles
+```
+
+### Create Client
+
+Clients are created inactive by default. Requires user auth.
+
+```bash
+b2c am clients create \
+  --name "My API Client" \
+  --orgs <org-id> \
+  --password "securePassword123"
+
+# with roles, role tenant filter, and redirect URLs
+b2c am clients create \
+  --name "CI/CD Pipeline" \
+  --orgs <org-id> \
+  --password "securePassword123" \
+  --roles SALESFORCE_COMMERCE_API \
+  --role-tenant-filter "SALESFORCE_COMMERCE_API:zzxy_prd" \
+  --redirect-urls "https://example.com/callback" \
+  --active
+```
+
+### Update Client
+
+Partial update -- only specified fields are changed.
+
+```bash
+b2c am clients update <api-client-id> --name "New Name"
+b2c am clients update <api-client-id> --active
+```
+
+### Change Client Password
+
+```bash
+b2c am clients password <api-client-id> --current "oldPass" --new "newSecurePass123"
+```
+
+### Delete Client
+
+Client must be disabled for 7+ days before deletion. Destructive operation (safe mode check).
+
+```bash
+b2c am clients delete <api-client-id>
+```
+
+## Users
+
+### List Users
+
+```bash
+b2c am users list
+
+# with extended columns (roles, organizations)
+b2c am users list --extended
+
+# JSON output with pagination
+b2c am users list --size 100 --json
+```
+
+### Get User
+
+```bash
+b2c am users get user@example.com
+
+# with expanded roles and organizations
+b2c am users get user@example.com --expand-all
+```
+
+### Create User
+
+```bash
+b2c am users create \
+  --org "My Organization" \
+  --mail user@example.com \
+  --first-name Jane \
+  --last-name Doe
+```
+
+The `--org` flag accepts either an org ID or org name. Users are created in INITIAL state with no roles.
+
+### Update User
+
+```bash
+b2c am users update user@example.com --first-name Janet --last-name Smith
+```
+
+### Delete User
+
+Soft-deletes by default. Use `--purge` for hard delete (user must already be in DELETED state).
+
+```bash
+# soft delete
+b2c am users delete user@example.com
+
+# hard delete (purge)
+b2c am users delete developer@example.com --purge
+```
+
+### Reset User Password
+
+Resets password to INITIAL state, clearing expiration. Destructive operation (safe mode check).
+
+```bash
+b2c am users reset user@example.com
+```
+
+## Roles
+
+### List Roles
+
+```bash
+b2c am roles list
+
+# filter by target type
+b2c am roles list --target-type User
+b2c am roles list --target-type ApiClient
+```
+
+### Get Role
+
+```bash
+b2c am roles get bm-admin
+b2c am roles get SLAS_ORGANIZATION_ADMIN
+```
+
+### Grant Role to User
+
+```bash
+b2c am roles grant user@example.com --role bm-admin
+
+# with tenant scope
+b2c am roles grant user@example.com --role bm-admin --scope zzzz_001,zzzz_002
+```
+
+### Revoke Role from User
+
+```bash
+# revoke entire role
+b2c am roles revoke user@example.com --role bm-admin
+
+# revoke specific tenant scopes only
+b2c am roles revoke user@example.com --role bm-admin --scope zzzz_001
+```
+
+## Organizations
+
+### List Organizations
+
+```bash
+b2c am orgs list
+
+# all organizations (max page size)
+b2c am orgs list --all
+
+# extended columns
+b2c am orgs list --extended
+```
+
+### Get Organization
+
+Accepts org ID or name.
+
+```bash
+b2c am orgs get <org-id>
+b2c am orgs get "My Organization"
+```
+
+## Business Manager Administration
+
+BM-side resources (instance roles, instance users, access keys, whoami) live in the **`b2c-cli:b2c-bm-users-roles`** skill. Use it for:
+
+- `b2c bm roles` — list/get/create/delete instance access roles, grant/revoke users, manage permissions
+- `b2c bm users` — list, get, search, update, and delete instance users via the OCAPI `/users` resource
+- `b2c bm whoami` — show the BM user the current OAuth token resolves to
+- `b2c bm access-key` — provision and rotate WebDAV/OCAPI/Storefront access keys for SSO-managed users
+
+Defer to that skill for BM examples and patterns. AM-side onboarding flows (creating an AM user, granting AM roles scoped to tenants) stay here.
+
+## Common Workflows
+
+### User Onboarding
+
+```bash
+# Create the user
+b2c am users create --org $ORG_ID --mail developer@example.com \
+  --first-name Alex --last-name Developer
+
+# Grant Business Manager Admin role scoped to a specific tenant
+b2c am roles grant developer@example.com --role bm-admin --scope zzxy_prd
+```
+
+### User Offboarding
+
+```bash
+# Revoke roles
+b2c am roles revoke developer@example.com --role bm-admin
+
+# Soft delete the user
+b2c am users delete developer@example.com
+
+# Permanent deletion (user must be in DELETED state first)
+b2c am users delete developer@example.com --purge
+```
+
+### Bulk Operations with JSON
+
+```bash
+# Export all users as JSON
+b2c am users list --size 4000 --json
+
+# Pipe to jq for filtering
+b2c am users list --json | jq '.[] | select(.userState == "ACTIVE")'
+```
+
+## Common Patterns
+
+All `am` commands support `--json` for programmatic output. List commands support `--columns`, `--extended`, `--size`, and `--page` for pagination and column control.
+
+Destructive operations (user delete, user reset, client delete) check safe mode. Only delete or purge users when explicitly requested.
+
+### More Commands
+
+See `b2c am --help` for a full list of available commands and options.

package/content/guidance/b2c-cli/b2c-bm-users-roles/SKILL.md

@@ -0,0 +1,210 @@
+---
+name: b2c-bm-users-roles
+description: Manage Business Manager users, access roles, role permissions, and per-user access keys on a B2C Commerce instance using the b2c CLI. Use this skill whenever the user needs to list or search BM users on a sandbox or production instance, identify which BM user an OAuth token resolves to ("whoami"), assign or revoke instance-level access roles, edit role permissions, look up a user's WebDAV / OCAPI / Storefront access key, or rotate access keys for SSO-managed users. Also use when the user asks "what's my BM login on sandbox X", "rotate my WebDAV password", "how do I make a custom BM role", "audit BM users on this instance", or "delete a stale BM user from a sandbox".
+---
+
+# B2C Business Manager Users, Roles, and Access Keys
+
+Use the `b2c bm` commands to administer instance-level Business Manager resources (users, roles, access keys) over SCAPI. These commands target a specific Commerce Cloud instance — pass `--server`/`-s` or set the active instance in `dw.json` first.
+
+> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli bm whoami`).
+
+For **Account Manager** user/role/client management (cross-instance, scoped to tenants), see the `b2c-cli:b2c-am` skill instead.
+
+## API Backend
+
+`bm users` (list, get, portable search, update, delete) and `bm roles` (all subcommands including permissions) run over the SCAPI Merchant Users / Merchant Roles APIs. Configure `shortCode`, `tenantId`, and the `sfcc.users(.rw)` / `sfcc.roles(.rw)` scopes to use SCAPI. Search is implemented by filtering the paginated SCAPI user listing.
+
+OCAPI-only operations as of B2C Commerce release 26.8 (no current live SCAPI equivalent, unavailable on OCAPI-disabled instances): raw `bm users search --query` JSON, `bm whoami`, and `bm access-key *`. `auto` uses the temporary OCAPI compatibility path. Explicit SCAPI mode fails before contacting OCAPI and directs the user to `--api-backend ocapi` until support becomes available.
+
+OCAPI is deprecated and disabled on newer instances. `--api-backend auto` (the default) falls back on safe SCAPI capability/auth/request rejections; force a backend with `--api-backend scapi|ocapi` if needed. SCAPI updates `disabled` by reading the current user and preserving its writable fields through PUT because PATCH omits that field.
+
+## Authentication
+
+The CLI auto-discovers the target instance and credentials from `SFCC_*` environment variables (including project `.env`), the selected project-local or shared `dw.json`, and configuration plugins. `package.json` supplies only non-sensitive defaults. **Flags like `--server`, `--client-id`, and `--client-secret` are usually unnecessary** — only pass them to override what's auto-detected. Run `b2c setup inspect` to see the resolved configuration and which source provided each value. For precedence and troubleshooting, see the `b2c-cli:b2c-config` skill.
+
+As of release 26.8, SCAPI Admin APIs require client credentials or JWT Bearer and do not support browser-based user auth. User auth continues to work through OCAPI and WebDAV, and `auto` selects OCAPI for that flow. Explicit SCAPI fails with actionable guidance. A handful of OCAPI endpoints require a _real BM user identity_ and default to user auth.
+
+| Command group                                  | Default auth                        | Why                                                                                          |
+| ---------------------------------------------- | ----------------------------------- | -------------------------------------------------------------------------------------------- |
+| `b2c bm roles ...`                             | client-credentials → jwt → implicit | OCAPI permissions for `/roles`                                                               |
+| `b2c bm users {list,get,search,update,delete}` | client-credentials → jwt → implicit | OCAPI permissions for `/users`                                                               |
+| `b2c bm whoami`                                | **implicit (browser)**              | OCAPI `/users/this` requires the token to resolve to a BM user                               |
+| `b2c bm access-key {get,create,set,delete}`    | **implicit (browser)**              | OCAPI access-key endpoints require "a valid user" plus `Manage_Users_Access_Keys` permission |
+
+Override the default with `--auth-methods client-credentials` (or `--client-secret` flags) when your service-client setup is configured to issue user-bearing tokens.
+
+## Business Manager Roles
+
+BM roles are instance-level Business Manager access roles (e.g. `Administrator`, `Support`, plus any custom roles).
+
+```bash
+# list roles on the configured instance
+b2c bm roles list
+
+# target a different instance
+b2c bm roles list --server my-sandbox.demandware.net
+
+# get role details, including assigned users
+b2c bm roles get Administrator --expand users
+
+# create a custom role
+b2c bm roles create MyEditor --description "Custom role for content editors"
+
+# delete a custom role (system roles cannot be deleted)
+b2c bm roles delete MyEditor
+
+# assign / unassign a user
+b2c bm roles grant user@example.com --role Administrator
+b2c bm roles revoke user@example.com --role Administrator
+
+# all commands accept --json for machine-readable output
+b2c bm roles list --json
+```
+
+### Role Permissions
+
+Permissions use a file-based get/set workflow because the API replaces the entire permission set on each write.
+
+```bash
+# view a permission summary
+b2c bm roles permissions get Administrator
+
+# export to a JSON file for editing
+b2c bm roles permissions get Administrator --output admin-perms.json
+
+# edit the file, then apply
+b2c bm roles permissions set Administrator --file admin-perms.json
+```
+
+The permissions JSON has four sections: `functional`, `module`, `locale`, and `webdav`. Each can be scoped to organization, site, or unscoped depending on the permission type.
+
+## Business Manager Users
+
+These commands cover the full lifecycle — **create/read/search/update/delete** — for BM users, plus the per-user access-key administration below. Note that `bm users create` is a create-or-replace that only works on instances configured to allow _local_ BM users; most production instances use SSO with Account Manager and reject it with `LocalUserCreationException`, in which case users are provisioned in Account Manager and managed here for the rest of their lifecycle.
+
+```bash
+# list (default 25)
+b2c bm users list
+b2c bm users list --count 50 --start 50            # pagination
+b2c bm users list --extended                       # add lastLogin, externalId
+b2c bm users list --columns login,email,lastLogin  # custom column set
+
+# get one user by login (email)
+b2c bm users get user@example.com
+
+# create a user (create-or-replace; --email required, --role repeatable)
+# only on instances that allow local users — else LocalUserCreationException
+b2c bm users create user@example.com --email user@example.com
+b2c bm users create user@example.com --email user@example.com --first-name Jane --last-name Doe --role Administrator
+
+# search by attribute (any combination of flags)
+b2c bm users search --search-phrase smith
+b2c bm users search --login user@example.com
+b2c bm users search --locked --sort-by last_login_date --sort-order desc
+b2c bm users search --query '{"text_query":{"fields":["login"],"search_phrase":"foo"}}'
+
+# update non-identity fields (locale, external_id, disabled, name)
+b2c bm users update user@example.com --disabled
+b2c bm users update user@example.com --no-disabled --preferred-ui-locale en_US
+b2c bm users update user@example.com --first-name Jane --last-name Doe
+
+# delete (prompts for confirmation; --force to skip)
+b2c bm users delete user@example.com
+b2c bm users delete user@example.com --force --json
+```
+
+**Cannot be updated via `update`:** the `locked` flag and the user `password` (those are governed by AM/SSO).
+
+## Whoami — Identify the Current BM User
+
+`bm whoami` calls `GET /users/this` and returns the BM user the OAuth token resolves to. Useful for verifying which identity will be used for downstream commands and for sanity-checking that a token actually carries a user claim.
+
+```bash
+b2c bm whoami
+b2c bm whoami --json
+```
+
+Defaults to browser-based user-auth — a fresh shell will trigger an `b2c auth login` flow. Once logged in, the saved session is reused across commands until it expires.
+
+## Access Keys (WebDAV, OCAPI, Storefront)
+
+Access keys let SSO-managed BM users authenticate to non-OAuth surfaces (WebDAV, classic OCAPI/SCAPI Basic auth, or Storefront diagnostics). Three scopes exist; pick the one matching the surface you need to use.
+
+| Scope                         | Used for                                              |
+| ----------------------------- | ----------------------------------------------------- |
+| `WEBDAV_AND_STUDIO` (default) | WebDAV uploads (cartridge sync, IMPEX), Studio access |
+| `AGENT_USER_AND_OCAPI`        | Customer Service Center (CSC) and OCAPI Basic auth    |
+| `STOREFRONT`                  | Storefront diagnostic / agent login passwords         |
+
+`[LOGIN]` is **optional** on every access-key command — when omitted, the CLI calls `bm whoami` first and operates on your own user. Passing an explicit login lets administrators manage someone else's keys (requires `Manage_Users_Access_Keys` permission).
+
+```bash
+# get access-key state for the current user (defaults to WEBDAV_AND_STUDIO)
+b2c bm access-key get
+b2c bm access-key get --scope STOREFRONT
+b2c bm access-key get user@example.com --scope AGENT_USER_AND_OCAPI
+
+# create or rotate an access key — the secret is shown ONCE at creation
+b2c bm access-key create
+b2c bm access-key create --scope STOREFRONT
+b2c bm access-key create --json | jq -r '.access_key'
+
+# enable / disable an existing key
+b2c bm access-key set --enabled
+b2c bm access-key set --no-enabled
+b2c bm access-key set user@example.com --scope STOREFRONT --enabled
+
+# delete (prompts for confirmation; --force to skip)
+b2c bm access-key delete
+b2c bm access-key delete --scope STOREFRONT --force
+```
+
+> **Important:** the `access_key` value is only returned in the response of `create`. Subsequent `get` calls do not return it. If you lose the value, run `create` again — the previous key is removed automatically.
+
+## Common Workflows
+
+### Rotate my own WebDAV password (no admin privileges needed)
+
+```bash
+b2c bm access-key create
+# record the printed access_key — it's the new password for WebDAV/IMPEX
+```
+
+### Audit users with admin role and stale logins
+
+```bash
+b2c bm roles get Administrator --expand users --json | jq '.users[].login'
+b2c bm users search --sort-by last_login_date --sort-order asc --json
+```
+
+### Provision a new custom role and assign one user
+
+```bash
+b2c bm roles create MyEditor --description "Content editors"
+b2c bm roles permissions get MyEditor --output role.json
+# edit role.json
+b2c bm roles permissions set MyEditor --file role.json
+b2c bm roles grant editor@example.com --role MyEditor
+```
+
+### Cycle access keys for an SSO user (admin)
+
+```bash
+# disable temporarily
+b2c bm access-key set user@example.com --scope WEBDAV_AND_STUDIO --no-enabled
+
+# rotate
+b2c bm access-key create user@example.com --scope WEBDAV_AND_STUDIO
+```
+
+## Common Patterns
+
+- All list/search commands support `--columns`, `--extended` / `-x`, and `--json`.
+- `bm users` and `bm roles` use OCAPI pagination: `--count`/`-n` and `--start`. AM commands use `--size`/`--page` instead — don't mix them up.
+- Destructive commands (`bm users delete`, `bm access-key delete`) prompt for confirmation. Use `--force` for non-interactive scripts. `--json` mode skips the prompt automatically.
+- When a service client cannot resolve a BM user (e.g. AM-only credential), `whoami` and `access-key` commands return `UserNotAvailableException` from the API — re-run with `--user-auth` or `b2c auth login` first.
+
+### More
+
+See `b2c bm --help`, `b2c bm users --help`, and `b2c bm access-key --help` for the full flag list. The OCAPI Data API user resource documentation describes the underlying endpoints and their fault codes.

package/content/guidance/b2c-cli/b2c-cap/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: b2c-cap
+description: Manage Commerce App Packages (CAPs), also called commerce apps or apps, and commerce features using the b2c CLI. Use this skill whenever the user needs to validate, package, install, uninstall, list, or pull commerce apps on B2C Commerce instances, view configuration tasks, or pull app sources for cartridge deployment or Storefront Next development. Also use when checking which apps are installed on an instance, inspecting app details or versions, or managing app lifecycle — even if they just say "what apps do I have", "list my commerce apps", "which CAPs are installed", "install this app", "pull app sources", or "show installed apps".
+---
+
+# B2C CAP Skill
+
+Use the `b2c` CLI plugin to **validate, package, install, uninstall, list, and pull** Commerce App Packages (CAPs) and commerce features on Salesforce B2C Commerce instances.
+
+> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli cap list`).
+
+## Configuration & Authentication
+
+The CLI auto-discovers the target instance and credentials from `SFCC_*` environment variables (including project `.env`), the selected project-local or shared `dw.json`, and configuration plugins. `package.json` supplies only non-sensitive defaults. **Flags like `--server`, `--client-id`, and `--client-secret` are usually unnecessary** — only pass them to override what's auto-detected.
+
+Run `b2c setup inspect` to see the resolved configuration and which source provided each value (use `--json` for scripting; secrets stay masked by default). For precedence rules and troubleshooting, see the `b2c-cli:b2c-config` skill.
+
+The remote commands (`cap install`, `cap uninstall`, `cap tasks`, `cap pull`, and `cap list` without `--local`) require OAuth for SCAPI-first system-job execution and **WebDAV** access for uploading/downloading archives. In `auto` mode, job execution temporarily falls back to OCAPI when SCAPI definitively rejects the start request. WebDAV authenticates via `SFCC_USERNAME`/`SFCC_PASSWORD` (BM username + WebDAV access key), `--user-auth` for interactive browser login, or an Account Manager OAuth client granted WebDAV permissions on the `/impex` path; SCAPI is not a substitute for the WebDAV upload. The local-only commands (`cap validate`, `cap package`, and `cap list --local`) need no credentials.
+
+> **Authoring vs. operating:** This skill covers **operating** on existing CAPs against an instance (validate, package, install, uninstall, list, tasks, pull). To **author** a new CAP — scaffold the structure, generate IMPEX, run registry-grade validation, or submit to the registry — install the `cap-dev` skills with `b2c setup skills cap-dev`, or via the commerce-apps marketplace: `claude plugin marketplace add SalesforceCommerceCloud/commerce-apps` then `claude plugin install cap-dev`.
+
+## Examples
+
+### List Installed Features
+
+```bash
+# list all commerce features across all sites
+b2c cap list
+
+# list features for specific sites
+b2c cap list --site-id RefArch,SiteGenesis
+
+# list with full JSON output (includes config tasks and installation metadata)
+b2c cap list --json
+
+# list locally detected CAP directories
+b2c cap list --local
+```
+
+### Pull App Sources
+
+Pull installed Commerce App source packages for cartridge deployment or Storefront Next (`sfnext`) development. Pulled apps are extracted into `./commerce-apps/{name}/`. Depending on the app's architecture, a package may contain `cartridges/` and `impex/` data (backend or fullstack apps) and/or `storefront-next/` extensions (UI-only or fullstack apps) ready for use with the `sfnext` CLI.
+
+```bash
+# pull all registry apps to ./commerce-apps
+b2c cap pull
+
+# pull a specific app by name
+b2c cap pull avalara-tax
+
+# pull to a custom output directory
+b2c cap pull --output ./my-apps
+
+# pull apps installed on a specific site
+b2c cap pull --site-id RefArch
+```
+
+### View Configuration Tasks
+
+```bash
+# show configuration tasks with clickable BM links
+b2c cap tasks avalara-tax --site-id RefArch
+
+# get tasks as JSON
+b2c cap tasks avalara-tax --site-id RefArch --json
+```
+
+### Validate a CAP
+
+```bash
+# validate a local CAP directory
+b2c cap validate ./commerce-avalara-tax-app-v0.2.5
+
+# validate a CAP zip file (cap package produces {id}-v{version}.zip)
+b2c cap validate ./avalara-tax-v0.2.5.zip
+
+# validate with JSON output
+b2c cap validate ./commerce-avalara-tax-app-v0.2.5 --json
+```
+
+### Package a CAP
+
+```bash
+# package a CAP directory into a distributable zip
+b2c cap package ./commerce-avalara-tax-app-v0.2.5
+
+# package with a custom output path
+b2c cap package ./commerce-avalara-tax-app-v0.2.5 --output ./dist/my-app.zip
+```
+
+> Every cartridge under `cartridges/site_cartridges/` and `cartridges/bm_cartridges/` must have a `.project` file. `cap package` auto-creates an empty one for any cartridge missing it (existing `.project` files, empty or full Eclipse XML, are left untouched); `cap validate` fails if any cartridge is still missing one.
+
+### Install a CAP
+
+```bash
+# install a CAP directory on an instance
+b2c cap install ./commerce-avalara-tax-app-v0.2.5 --site-id RefArch
+
+# install a pre-packaged zip
+b2c cap install ./avalara-tax-v0.2.5.zip --site-id RefArch
+
+# install with a timeout
+b2c cap install ./commerce-avalara-tax-app-v0.2.5 --site-id RefArch --timeout 600
+
+# skip validation before install
+b2c cap install ./commerce-avalara-tax-app-v0.2.5 --site-id RefArch --skip-validate
+
+# remove the uploaded archive after install
+b2c cap install ./commerce-avalara-tax-app-v0.2.5 --site-id RefArch --clean-archive
+
+# create a Storefront Next pull request for the app's storefront content
+# (requires a repository connected to the storefront; off by default)
+b2c cap install ./commerce-avalara-tax-app-v0.2.5 --site-id RefArch --create-pr
+```
+
+### Uninstall a CAP
+
+```bash
+# uninstall a commerce app (domain is looked up automatically)
+b2c cap uninstall avalara-tax --site-id RefArch
+```
+
+### More Commands
+
+See `b2c cap --help` for a full list of available commands and options in the `cap` topic.
+
+## Related Skills
+
+- `b2c-cli:b2c-job` - For running general jobs and site archive import/export
+- `b2c-cli:b2c-site-import-export` - For site archive structure and metadata XML patterns
+- `b2c-cli:b2c-code` - For deploying cartridges pulled from Commerce Apps