@salesforce/b2c-dx-mcp 3.0.1 → 3.1.0

package/content/guidance/b2c-cli/b2c-config/SKILL.md

@@ -31,6 +31,23 @@ Sources, in resolution order (highest priority first):
 
 For unexpected values, inspect resolved configuration and sources with `config_inspect` or `b2c setup inspect`.
 
+### Storefront Next Environment Compatibility
+
+The resolver accepts these Storefront Next variables as fallbacks, so a project
+can reuse its existing B2C Commerce and SLAS configuration:
+
+| Storefront Next variable                     | Resolved field     | Default toolkit variable  |
+| -------------------------------------------- | ------------------ | ------------------------- |
+| `PUBLIC__app__commerce__api__clientId`       | `slasClientId`     | `SFCC_SLAS_CLIENT_ID`     |
+| `PUBLIC__app__commerce__api__organizationId` | `tenantId`         | `SFCC_TENANT_ID`          |
+| `PUBLIC__app__commerce__api__shortCode`      | `shortCode`        | `SFCC_SHORTCODE`          |
+| `COMMERCE_API_SLAS_SECRET`                   | `slasClientSecret` | `SFCC_SLAS_CLIENT_SECRET` |
+| `PUBLIC__app__defaultSiteId`                 | `siteId`           | `SFCC_SITE_ID`            |
+| `MRT_PROJECT`                                | `mrtProject`       | `MRT_PROJECT`             |
+| `MRT_TARGET`                                 | `mrtEnvironment`   | `MRT_ENVIRONMENT`         |
+
+Explicit flags and default toolkit variables win over these fallbacks.
+
 ### Shared Global Default
 
 Use a shared fallback when the same `dw.json`-format file should work across the CLI, MCP server, and B2C DX VS Code extension:
@@ -263,7 +280,7 @@ The `setup inspect` command displays configuration organized by category:
 - **Managed Runtime (MRT)**: mrtProject, mrtEnvironment, mrtApiKey, mrtOrigin (if set)
 - **Project**: configured deployment, content, and documentation defaults
 - **Metadata**: siteId, instanceName, and projectDirectory (only shown when configured)
-- **Safety**: safety configuration (only shown when configured)
+- **Safety**: effective level, level-based confirmation, source column, and rule count after combining instance, global-file, and environment settings (only shown when configured). `SafetyFile` identifies the global file listed in Sources; `SafetyEnv` identifies environment settings. Use `--verbose` for numbered rules in matching order with their sources, or `--json` for the complete effective safety object. Explicit confirmation rules still apply when level confirmation is disabled.
 - **Sources**: List of all configuration sources that were loaded
 
 Each value shows its source in brackets:

package/content/guidance/b2c-cli/b2c-job/SKILL.md

@@ -39,7 +39,9 @@ Deletion removes completed execution records; it does not cancel jobs.
 
 ```bash
 b2c job import ./archive --show-log
+b2c job import ./storefront-export.zip --wait-for-storefront
 b2c job export --site MySite --site-data campaigns_and_promotions --output ./export
+b2c job export --storefront my-storefront --output ./export
 ```
 
 Import/export wait by default and transfer files over WebDAV. Jobs prefer SCAPI

package/content/guidance/b2c-cli/b2c-job/references/EXPORT.md

@@ -39,6 +39,9 @@ b2c job export --site RefArch
 # export a site with specific site data units
 b2c job export --site RefArch --site-data content,site_preferences
 
+# export one composable storefront by storefront name
+b2c job export --storefront my-storefront
+
 # export multiple sites
 b2c job export --site RefArch --site SiteGenesis --site-data campaigns_and_promotions
 
@@ -98,6 +101,7 @@ Do not require a temporary directory and copy step for export-based migrations.
 | Flag               | Description                                                                    |
 | ------------------ | ------------------------------------------------------------------------------ |
 | `--site`           | Site IDs to export (use `--site-data` to pick specific units, defaults to all) |
+| `--storefront`     | One composable storefront name                                                 |
 | `--catalog`        | Catalog IDs                                                                    |
 | `--library`        | Library IDs                                                                    |
 | `--inventory-list` | Inventory list IDs                                                             |
@@ -106,10 +110,12 @@ Do not require a temporary directory and copy step for export-based migrations.
 
 **Site data units** (use with `--site-data`):
 
-`ab_tests`, `active_data_feeds`, `all`, `cache_settings`, `campaigns_and_promotions`, `content`, `coupons`, `custom_objects`, `customer_cdn_settings`, `customer_groups`, `distributed_commerce_extensions`, `dynamic_file_resources`, `gift_certificates`, `ocapi_settings`, `payment_methods`, `payment_processors`, `redirect_urls`, `search_settings`, `shipping`, `site_descriptor`, `site_preferences`, `sitemap_settings`, `slots`, `sorting_rules`, `source_codes`, `static_dynamic_alias_mappings`, `stores`, `tax`, `url_rules`
+`ab_tests`, `active_data_feeds`, `all`, `cache_settings`, `campaigns_and_promotions`, `channels`, `commerce_feature_states`, `content`, `coupons`, `custom_objects`, `customer_cdn_settings`, `customer_groups`, `distributed_commerce_extensions`, `dynamic_file_resources`, `gift_certificates`, `ocapi_settings`, `payment_methods`, `payment_processors`, `point_of_sale_channels`, `redirect_urls`, `search_settings`, `shipping`, `site_descriptor`, `site_preferences`, `sitemap_settings`, `slots`, `sorting_rules`, `source_codes`, `static_dynamic_alias_mappings`, `stores`, `tax`, `url_rules`
 
 **Global data units** (use with `--global-data`):
 
-`access_roles`, `all`, `csc_settings`, `csrf_whitelists`, `custom_preference_groups`, `custom_quota_settings`, `custom_types`, `geolocations`, `global_custom_objects`, `job_schedules`, `job_schedules_deprecated`, `locales`, `meta_data`, `oauth_providers`, `ocapi_settings`, `page_meta_tags`, `preferences`, `price_adjustment_limits`, `services`, `sorting_rules`, `static_resources`, `system_type_definitions`, `users`, `webdav_client_permissions`
+`access_roles`, `all`, `csc_settings`, `csrf_whitelists`, `custom_preference_groups`, `custom_quota_settings`, `custom_types`, `event_routing`, `geolocations`, `global_custom_objects`, `job_schedules`, `job_schedules_deprecated`, `locales`, `meta_data`, `oauth_providers`, `ocapi_settings`, `page_meta_tags`, `preferences`, `price_adjustment_limits`, `services`, `sorting_rules`, `static_resources`, `system_type_definitions`, `users`, `webdav_client_permissions`
+
+For full control over the export configuration (including `assignments`, `catalog_static_resources`, `library_static_resources`, and `customer_lists`), use `--data-units` with a JSON string matching the `ExportDataUnitsConfiguration` shape. The `storefronts` object is keyed by storefront name and may select only one storefront.
 
-For full control over the export configuration (including `catalog_static_resources`, `library_static_resources`, and `customer_lists`), use `--data-units` with a JSON string matching the `ExportDataUnitsConfiguration` shape.
+The `storefronts` export data unit requires B2C Commerce 26.10 or later. Failed storefront exports include a version note alongside the original error; check the instance version when the server rejects this data unit.

package/content/guidance/b2c-cli/b2c-job/references/IMPORT.md

@@ -23,12 +23,24 @@ b2c job import existing-archive.zip --remote
 # show job log on failure
 b2c job import ./my-site-data --show-log
 
+# wait for Storefront Next post-import setup after the archive import succeeds
+b2c job import ./storefront-export.zip --wait-for-storefront
+
 # import only a subset of a directory (extra positionals are paths/globs
 # resolved against the directory; preserves layout inside the archive)
 b2c job import ./my-site-data sites/RefArch libraries/mylib
 b2c job import ./my-site-data 'libraries/**'
 ```
 
+`--wait-for-storefront` snapshots existing setup-job executions before import,
+waits for the archive import to succeed, and then polls briefly for the newly
+triggered `sfcc-post-import-setup-storefront` execution before waiting for it to
+finish. It cannot be combined with `--no-wait`. If no new setup execution appears
+within 60 seconds, the CLI checks available import logs and includes `[DATAERROR]`
+entries in the timeout error. Logs are downloaded for this diagnostic only on
+discovery timeout. Resolve any reported data errors before retrying; if logs are
+unavailable or contain no data errors, inspect the import contents and recent job executions.
+
 ### Import Sets
 
 `job import-set` first applies site import/export archives from discovered cartridge `metadata/` sources, then applies archives in `./migrations`, and skips archives already recorded on the target instance:

package/content/guidance/b2c-cli/b2c-mrt/SKILL.md

@@ -17,15 +17,16 @@ Run `b2c setup inspect` to see the resolved configuration and which source provi
 
 ### MRT Backends (legacy vs SCAPI)
 
-Most MRT commands run against the legacy MRT Cloud API (API key). Two commands — `mrt bundle history` and `mrt bundle deploy <bundleId>` — can also run over the SCAPI MRT backend. Choose with `--mrt-backend` (`MRT_BACKEND` / `SFCC_MRT_BACKEND`, or `mrtBackend` in `dw.json`):
+Most MRT commands run against the legacy MRT Cloud API (API key). Several commands can also run over the SCAPI MRT backend: `mrt bundle history`, `mrt bundle list`, `mrt bundle deploy` (both the local-build push and deploying an existing `<bundleId>`), and the `mrt env var` family (`list` / `set` / `push` / `delete`). Choose with `--mrt-backend` (`MRT_BACKEND` / `SFCC_MRT_BACKEND`, or `mrtBackend` in `dw.json`):
 
-- `auto` (default) — use SCAPI when it's configured (`--short-code` + `--tenant-id` + client-credentials or JWT Bearer auth; scopes `sfcc.storefront.deployments[.rw]`), otherwise legacy. Falls back to legacy on safe pre-execution errors.
+- `auto` (default) — use SCAPI when it's configured (`--short-code` + `--tenant-id` + client-credentials or JWT Bearer auth), otherwise legacy. Falls back to legacy on safe pre-execution errors. Each command requests its own scopes: bundle commands use `sfcc.storefront.deployments[.rw]`; env var commands use `sfcc.storefront.environments[.rw]` (reads accept either tier, writes require `.rw`).
 - `legacy` — always the MRT Cloud API.
-- `scapi` — always SCAPI, with no fallback; errors if prerequisites are missing. Also errors on unsupported commands and on the local-build push path (`deploy` with no bundle ID).
+- `scapi` — always SCAPI, with no fallback; errors if prerequisites are missing. Also errors on unsupported commands (every MRT command except the bundle and env var commands above).
 
 Notes:
 
-- Under `--json`, these commands emit the **serving backend's native shape** (legacy `{count, next, previous, deployments}` vs SCAPI `{limit, offset, total, data}`). The human table is normalized; `--json` is not. Pin `legacy` or `scapi` when a script needs a stable shape.
+- Under `--json`, these commands emit the **serving backend's native shape** (e.g. `bundle history` is legacy `{count, next, previous, deployments}` vs SCAPI `{limit, offset, total, data}`; `env var list` is legacy `{count, variables}` vs the SCAPI native environment-variables map). The human table is normalized; `--json` is not. Pin `legacy` or `scapi` when a script needs a stable shape.
+- Env vars over SCAPI use the Storefront Environments API. `set` and `delete` apply a merge-PATCH (only the keys you pass change; `delete` sends the key with a `null` value); values are always masked by both backends. `push` resolves the backend once from its initial read and pins every write to it, so a single `push` never crosses backends.
 - Legacy-only flags (`--api-key`, `--cloud-origin` / `-u`, `--credentials-file` / `-c`) are ignored — with a warning — when SCAPI serves the request.
 - `--storefront` (long) and `-s` (short) are aliases of `--project` / `-p` — the SCAPI storefront ID is the project slug, so all four are interchangeable on every `mrt` command. On `mrt project create` this flag sets the new project's slug (auto-generated from the name if omitted); `mrt bundle save` uses `-d` for `--save-dir`, keeping `-s` free for the storefront alias.
 

package/content/guidance/b2c-cli/b2c-mrt/references/BUNDLE-COMMANDS.md

@@ -31,11 +31,22 @@ b2c mrt bundle deploy -p my-storefront --ssr-param SSRProxyPath=/api
 b2c mrt bundle deploy -p my-storefront \
   --ssr-param SSRProxyPath=/api \
   --ssr-param SSRTimeout=30000
+
+# Push a local build and deploy it via the SCAPI backend
+b2c mrt bundle deploy -p my-storefront -e staging --mrt-backend scapi
+
+# Push via SCAPI with a custom v2 archive layout
+b2c mrt bundle deploy -p my-storefront --mrt-backend scapi --root-dir bld --match-mode ignore_missing
+
+# Push via the legacy v2 endpoint (opt in with --v2)
+b2c mrt bundle deploy -p my-storefront --mrt-backend legacy --v2 --match-mode ignore_missing
 ```
 
+**Bundle format:** SCAPI always uploads the v2 format. The legacy backend defaults to v1; pass `--v2` to upload through the legacy v2 endpoint (upload, plus a separate deploy when `-e` is given). `--root-dir`, `--config-path`, and `--match-mode` control the v2 archive layout and only take effect on a v2 upload — on a legacy v1 push they are ignored and the command warns (pass `--v2` to enable them). `b2c mrt bundle deploy --v2` performs the same v2 upload as `b2c mrt bundle upload-v2` and can also deploy in one step.
+
 ### Deploy Existing Bundle
 
-Deploying an existing bundle (with a bundle ID) is backend-aware — it honors `--mrt-backend` (`auto` / `legacy` / `scapi`). Pushing a local build is legacy-pinned. See the "MRT Backends" section in the skill overview.
+Both the local-build push and deploying an existing bundle (with a bundle ID) are backend-aware — they honor `--mrt-backend` (`auto` / `legacy` / `scapi`). For a local-build push under `auto`, a safe SCAPI upload failure falls back to legacy, but once the bundle is uploaded a later deploy failure is not retried on legacy (so a bundle is never uploaded twice). See the "MRT Backends" section in the skill overview.
 
 ```bash
 # Deploy existing bundle by ID
@@ -55,6 +66,10 @@ b2c mrt bundle deploy 12345 -p my-storefront -e production --mrt-backend scapi -
 | `--build-dir`, `-b` | Path to build directory | `build` |
 | `--ssr-only` | Server-only file patterns | `ssr.js,ssr.mjs,server/**/*` |
 | `--ssr-shared` | Shared file patterns | `static/**/*,client/**/*` |
+| `--v2` | Use the v2 bundle format/endpoint (SCAPI always uses v2; opt in on legacy) | `false` |
+| `--root-dir` | Archive path prefix for built files and the config file (v2 uploads only) | `bld` |
+| `--config-path` | In-archive config file path, relative to `--root-dir` (v2 uploads only) | `.mrt/config.json` |
+| `--match-mode` | Handling of SSR patterns matching no files — `strict` or `ignore_missing` (v2 uploads only) | `strict` |
 | `--node-version`, `-n` | Node.js version for SSR | `24.x` |
 | `--ssr-param` | SSR parameters (key=value, can repeat) | |
 
@@ -102,16 +117,19 @@ b2c mrt bundle upload-v2 -p my-storefront --dependencies @./deps.json --cc-overr
 
 ## Bundle List
 
-List bundles in a project.
+List bundles in a project. Backend-aware (`--mrt-backend`); under `--json` it returns the serving backend's native response verbatim (legacy vs SCAPI shapes differ).
 
 ```bash
 b2c mrt bundle list --project my-storefront
 b2c mrt bundle list -p my-storefront --limit 10
 b2c mrt bundle list -p my-storefront --offset 20
 b2c mrt bundle list -p my-storefront --json
+
+# Force the SCAPI backend
+b2c mrt bundle list -p my-storefront --mrt-backend scapi
 ```
 
-**Output columns:** Bundle ID, Message, Status, Created
+**Output columns:** Bundle ID, Message, Status, User, Created
 
 ## Bundle History
 

package/content/guidance/b2c-cli/b2c-mrt/references/ENVIRONMENT-COMMANDS.md

@@ -110,11 +110,16 @@ b2c mrt env b2c -p my-storefront -e production --clear-sites
 
 ## Environment Variables
 
+The `mrt env var` commands (`list` / `set` / `push` / `delete`) are backend-aware: they honor `--mrt-backend` (`auto` / `legacy` / `scapi`) and, over SCAPI, use the Storefront Environments API (scopes `sfcc.storefront.environments` for reads, `sfcc.storefront.environments.rw` for writes). See the [MRT Backends](../SKILL.md#mrt-backends-legacy-vs-scapi) section for backend selection. Values are always masked by both backends. `set` and `delete` apply a merge-PATCH — only the keys you pass change (`delete` sends the key with a `null` value); other variables are preserved. Under `--json`, each command returns the serving backend's native shape.
+
 ### List Variables
 
 ```bash
 b2c mrt env var list --project my-storefront --environment production
 b2c mrt env var list -p my-storefront -e staging --json
+
+# Force the SCAPI backend
+b2c mrt env var list -p my-storefront -e staging --mrt-backend scapi
 ```
 
 ### Set Variables
@@ -130,6 +135,9 @@ b2c mrt env var set API_KEY=secret DEBUG=true FEATURE_FLAG=enabled \
 # Value with spaces (use quotes)
 b2c mrt env var set "MESSAGE=hello world" -p my-storefront -e production
 
+# Force the SCAPI backend
+b2c mrt env var set API_KEY=secret -p my-storefront -e staging --mrt-backend scapi
+
 # Using environment variables for auth
 export MRT_API_KEY=your-api-key
 export MRT_PROJECT=my-storefront
@@ -137,10 +145,25 @@ export MRT_ENVIRONMENT=staging
 b2c mrt env var set MY_VAR=value
 ```
 
+### Push Variables from a .env File
+
+Diff a local `.env` file against the remote environment and apply the additions/updates (remote-only variables are not deleted). `push` resolves the backend once from its initial read and pins every write to it; over SCAPI the changes are applied as a single merge-PATCH.
+
+```bash
+# Push ./.env, with confirmation prompt
+b2c mrt env var push -p my-storefront -e production
+
+# Push a custom file, skipping confirmation, over SCAPI
+b2c mrt env var push -p my-storefront -e staging --file config/.env --yes --mrt-backend scapi
+```
+
 ### Delete Variable
 
 ```bash
 b2c mrt env var delete MY_VAR -p my-storefront -e production
+
+# Force the SCAPI backend
+b2c mrt env var delete MY_VAR -p my-storefront -e production --mrt-backend scapi
 ```
 
 ## URL Redirects

package/content/guidance/b2c-cli/b2c-webdav/SKILL.md

@@ -37,11 +37,28 @@ The `--root` flag specifies the WebDAV directory:
 - `catalogs` - Product catalogs
 - `libraries` - Content libraries
 - `static` - Static resources
+- `dynamic` - Site-specific files, including Velocity templates
 - `logs` - Application logs
 - `securitylogs` - Security logs
 
 ## Examples
 
+### Dynamic Site Files
+
+Use `--root=dynamic` with the site ID as the first remote path segment. For example,
+`MySite/mockData/mock.vm` resolves to `Sites/Dynamic/MySite/mockData/mock.vm`.
+This location holds site-specific files independently of code versions, including
+Velocity templates used by `dw.template.Velocity.renderTemplate()`.
+
+```bash
+b2c webdav ls --root=dynamic MySite/
+b2c webdav mkdir --root=dynamic MySite/mockData
+b2c webdav put --root=dynamic ./mock.vm MySite/mockData/
+b2c webdav get --root=dynamic MySite/mockData/mock.vm -o ./mock.vm
+```
+
+The same root and site-prefixed paths work with `rm`, `zip`, and `unzip`.
+
 ### List Files
 
 ```bash

package/content/guidance/index.json

@@ -129,11 +129,11 @@
       "description": "Configure B2C CLI/MCP authentication, instances, and project defaults; troubleshoot missing credentials, wrong targets, or configuration precedence. Routine inspection can use config_inspect or b2c setup inspect directly.",
       "entrypoint": "SKILL.md",
       "source": "skills/b2c-cli/skills/b2c-config/SKILL.md",
-      "headings": "B2C Config Skill | How the CLI Discovers Configuration | Shared Global Default | MCP Project Context | `dw.json` Key Casing | Authentication | `--user-auth` Flag | Tenant ID and Organization ID | Inspecting Configuration | When to Use | View Current Configuration | Debug Sensitive Values | JSON Output for Scripting | IDE Integration | Managing Instances | List Configured Instances | Create a New Instance | Switch Active Instance | Remove an Instance | Understanding the Output | Configuration Priority | Project Defaults in package.json | Troubleshooting | Command says \"credentials required\" or \"client-id is required\" | Command targets the wrong instance | `dw.json` is not being picked up | 401/403 errors on SCAPI/OCAPI calls | Missing `tenantId` / `shortCode` | MRT commands say \"API key required\" | Sensitive values masked in `setup inspect` | Missing values | Wrong source taking precedence | Still stuck | Getting Admin OAuth Tokens | More Commands",
+      "headings": "B2C Config Skill | How the CLI Discovers Configuration | Storefront Next Environment Compatibility | Shared Global Default | MCP Project Context | `dw.json` Key Casing | Authentication | `--user-auth` Flag | Tenant ID and Organization ID | Inspecting Configuration | When to Use | View Current Configuration | Debug Sensitive Values | JSON Output for Scripting | IDE Integration | Managing Instances | List Configured Instances | Create a New Instance | Switch Active Instance | Remove an Instance | Understanding the Output | Configuration Priority | Project Defaults in package.json | Troubleshooting | Command says \"credentials required\" or \"client-id is required\" | Command targets the wrong instance | `dw.json` is not being picked up | 401/403 errors on SCAPI/OCAPI calls | Missing `tenantId` / `shortCode` | MRT commands say \"API key required\" | Sensitive values masked in `setup inspect` | Missing values | Wrong source taking precedence | Still stuck | Getting Admin OAuth Tokens | More Commands",
       "files": [
         {
           "path": "SKILL.md",
-          "bytes": 22816
+          "bytes": 24384
         }
       ]
     },
@@ -231,11 +231,11 @@
       "files": [
         {
           "path": "references/EXPORT.md",
-          "bytes": 5933
+          "bytes": 6540
         },
         {
           "path": "references/IMPORT.md",
-          "bytes": 2106
+          "bytes": 2904
         },
         {
           "path": "references/RUN-AND-MONITOR.md",
@@ -243,7 +243,7 @@
         },
         {
           "path": "SKILL.md",
-          "bytes": 2740
+          "bytes": 2861
         }
       ]
     },
@@ -284,15 +284,15 @@
       "description": "Deploy and manage Managed Runtime (MRT) storefronts using the b2c CLI. Use this skill whenever the user needs to deploy a PWA Kit bundle, manage MRT environments and projects, set environment variables, configure URL redirects, or manage organization connections — even if they just say \"deploy my PWA\" or \"set up a staging environment\".",
       "entrypoint": "SKILL.md",
       "source": "skills/b2c-cli/skills/b2c-mrt/SKILL.md",
-      "headings": "MRT Bundle Commands Reference | Bundle Deploy | Push Local Build | Deploy Existing Bundle | Bundle Upload (v2) | Bundle List | Bundle History | Bundle Download | Common Workflows | Development to Production Pipeline | Rollback to Previous Bundle | Download and Inspect Bundle | MRT Environment Commands Reference | Environment Management | List Environments | Create Environment | Get Environment Details | Update Environment | Delete Environment | Invalidate Cache | B2C Commerce Connection | Environment Variables | List Variables | Set Variables | Delete Variable | URL Redirects | List Redirects | Create Redirect | Delete Redirect | Clone Redirects | Access Control Headers | List Access Control Headers | MRT Project Commands Reference | Project Management | List Projects | Create Project | Get Project Details | Update Project | Delete Project | Member Management | List Members | Add Member | Get Member Details | Update Member Role | Remove Member | Deployment Notifications | List Notifications | Create Notification | Get Notification Details | Update Notification | Delete Notification | B2C MRT Skill | Configuration & Authentication | MRT Backends (legacy vs SCAPI) | Command Structure | Quick Examples | Deploy a Bundle | Manage Environments | Environment Variables | View Deployment History | Organization Members and Certificates | Project Management | URL Redirects | Configuration | dw.json | Environment Variables | ~/.mobify Config | Detailed References | More Commands",
+      "headings": "MRT Bundle Commands Reference | Bundle Deploy | Push Local Build | Deploy Existing Bundle | Bundle Upload (v2) | Bundle List | Bundle History | Bundle Download | Common Workflows | Development to Production Pipeline | Rollback to Previous Bundle | Download and Inspect Bundle | MRT Environment Commands Reference | Environment Management | List Environments | Create Environment | Get Environment Details | Update Environment | Delete Environment | Invalidate Cache | B2C Commerce Connection | Environment Variables | List Variables | Set Variables | Push Variables from a .env File | Delete Variable | URL Redirects | List Redirects | Create Redirect | Delete Redirect | Clone Redirects | Access Control Headers | List Access Control Headers | MRT Project Commands Reference | Project Management | List Projects | Create Project | Get Project Details | Update Project | Delete Project | Member Management | List Members | Add Member | Get Member Details | Update Member Role | Remove Member | Deployment Notifications | List Notifications | Create Notification | Get Notification Details | Update Notification | Delete Notification | B2C MRT Skill | Configuration & Authentication | MRT Backends (legacy vs SCAPI) | Command Structure | Quick Examples | Deploy a Bundle | Manage Environments | Environment Variables | View Deployment History | Organization Members and Certificates | Project Management | URL Redirects | Configuration | dw.json | Environment Variables | ~/.mobify Config | Detailed References | More Commands",
       "files": [
         {
           "path": "references/BUNDLE-COMMANDS.md",
-          "bytes": 7241
+          "bytes": 9061
         },
         {
           "path": "references/ENVIRONMENT-COMMANDS.md",
-          "bytes": 5493
+          "bytes": 7026
         },
         {
           "path": "references/PROJECT-COMMANDS.md",
@@ -300,7 +300,7 @@
         },
         {
           "path": "SKILL.md",
-          "bytes": 7994
+          "bytes": 8753
         }
       ]
     },
@@ -417,11 +417,11 @@
       "description": "List, upload, download, and manage files on B2C Commerce instances via WebDAV. Use this skill whenever the user needs to upload files to IMPEX directories, download exports from an instance, list remote files, create or delete directories, zip or unzip files on the server, manage file transfers to sandboxes, or browse instance file systems — even if they just say \"upload a file to the instance\" or \"check what's in the IMPEX folder\".",
       "entrypoint": "SKILL.md",
       "source": "skills/b2c-cli/skills/b2c-webdav/SKILL.md",
-      "headings": "B2C WebDAV Skill | MCP equivalent | Configuration & Authentication | WebDAV Roots | Examples | List Files | Download Files | Upload Files | Create Directories | Delete Files | Delete Cartridges | Zip/Unzip Remote Files | Import-Set Managed State | More Commands | Related Skills",
+      "headings": "B2C WebDAV Skill | MCP equivalent | Configuration & Authentication | WebDAV Roots | Examples | Dynamic Site Files | List Files | Download Files | Upload Files | Create Directories | Delete Files | Delete Cartridges | Zip/Unzip Remote Files | Import-Set Managed State | More Commands | Related Skills",
       "files": [
         {
           "path": "SKILL.md",
-          "bytes": 6088
+          "bytes": 6788
         }
       ]
     },
@@ -1313,7 +1313,7 @@
       "title": "b2c-config",
       "description": "MCP configuration, authentication setup, external access grants, and masked inspection. Use for setup or unresolved configuration issues; routine config_inspect needs no skill read.",
       "entrypoint": "SKILL.md",
-      "source": "guidance/mcp/b2c-config/SKILL.md",
+      "source": "packages/b2c-dx-mcp/skills/b2c-config/SKILL.md",
       "headings": "MCP Configuration | Inspect resolved values | Where configuration comes from | Setup and access | CLI, when requested | Further reading",
       "files": [
         {
@@ -1329,7 +1329,7 @@
       "title": "MCP CIP Analytics",
       "description": "Discover and run CIP reports or analytics SQL for sales, merchandising, and technical operations. Resolve warehouse access, bound results, and interpret site/date scope.",
       "entrypoint": "SKILL.md",
-      "source": "guidance/mcp/cip/SKILL.md",
+      "source": "packages/b2c-dx-mcp/skills/cip/SKILL.md",
       "headings": "CIP analytics | Choose and discover | Configuration and access | Query and interpret",
       "files": [
         {
@@ -1345,7 +1345,7 @@
       "title": "MCP Debugger Usage",
       "description": "Bounded debugger capture, request triggering, state inspection, and reliable session cleanup.",
       "entrypoint": "SKILL.md",
-      "source": "guidance/mcp/debugger/SKILL.md",
+      "source": "packages/b2c-dx-mcp/skills/debugger/SKILL.md",
       "headings": "MCP Debugger Usage | Prerequisites | Capture and cleanup | Stepping | Recovery | CLI or IDE, when requested",
       "files": [
         {
@@ -1361,8 +1361,8 @@
       "title": "MCP SCAPI Code Mode",
       "description": "Discover standard and live custom SCAPI contracts, compose Admin requests, and verify changes using configured authentication and safety rules.",
       "entrypoint": "SKILL.md",
-      "source": "guidance/mcp/scapi/SKILL.md",
-      "headings": "Custom Admin APIs | Live custom property definitions | Job review and investigation | Basic product creation | Join campaign assignments to promotions | Save a reusable workflow | Built-in SCAPI snippets | builtin/create-product | builtin/campaign-promotions | builtin/failed-job-triage | builtin/job-execution-review | builtin/job-execution-inspect | builtin/code-version-inspect | builtin/site-cartridge-inspect | Token exports for external clients | Account Manager | SLAS | Output and failures | SCAPI Code Mode | Discover | Task map | Tenant custom properties and APIs | Authentication | Compose and verify | Reusable workflows",
+      "source": "packages/b2c-dx-mcp/skills/scapi/SKILL.md",
+      "headings": "Custom Admin APIs | Live custom property definitions | Job review and investigation | Basic product creation | Join campaign assignments to promotions | Save a reusable workflow | Built-in SCAPI snippets | builtin/create-product | builtin/campaign-promotions | builtin/failed-job-triage | builtin/job-execution-review | builtin/job-execution-inspect | builtin/code-version-inspect | builtin/site-cartridge-inspect | Token exports for external clients | Account Manager | SLAS | Output and failures | SCAPI Code Mode | Discover | Task map | Tenant custom properties and APIs | Authentication | Compose and verify | Confirmation and cancellation | Reusable workflows",
       "files": [
         {
           "path": "references/custom-apis.md",
@@ -1398,7 +1398,7 @@
         },
         {
           "path": "SKILL.md",
-          "bytes": 9669
+          "bytes": 12530
         }
       ],
       "featured": true
@@ -1409,7 +1409,7 @@
       "title": "server",
       "description": "B2C MCP setup, toolset customization, available capabilities, tool choice, and skill discovery.",
       "entrypoint": "SKILL.md",
-      "source": "guidance/mcp/server/SKILL.md",
+      "source": "packages/b2c-dx-mcp/skills/server/SKILL.md",
       "headings": "Instance files and cartridge uploads | B2C MCP Server | Server configuration and tool availability | Tool choice and project configuration | Skills | Setup references",
       "files": [
         {

package/content/guidance/mcp/scapi/SKILL.md

@@ -33,18 +33,18 @@ runtime support, not configured access; `op.security` gives scopes.
 Use these API IDs to narrow discovery; inspect the operation's inputs before calling.
 Snippet names below have the `builtin/` prefix. Describe only the relevant snippet.
 
-| Task | API / starting point |
-| --- | --- |
-| Review runs, including successes | `operation/jobs/v1`: `searchJobExecutions`; `job-execution-review` snippet |
-| Inspect steps and exact log path | `operation/jobs/v1`: `getJobExecution`; `job-execution-inspect` snippet |
-| Investigate failures with detail reads | `failed-job-triage` snippet; [jobs](references/jobs.md) |
-| Start a job / stop an execution | `operation/jobs/v1`: `createJobExecution` / `deleteJobExecution`; confirm intent and active runs first |
-| Active/rollback versions, activation metadata | `dx/scripts/v1`: `getCodeVersions`; `code-version-inspect` snippet |
-| Activate/create/delete a code version | `dx/scripts/v1`: `updateCodeVersion` / `createCodeVersion` / `deleteCodeVersion` |
-| Site status, catalog, ordered cartridge path | `site/sites/v1`: `getSiteById`; `site-cartridge-inspect` snippet |
-| Change a site's custom cartridge path | `site/sites/v1`: `replaceSiteCustomCartridges`; preserve order and unrelated entries |
-| Basic product + optional category assignment | `create-product` snippet; [products](references/products.md) |
-| Campaign assignments and promotion details | `campaign-promotions` snippet; [promotions](references/promotions.md) |
+| Task                                          | API / starting point                                                                                   |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| Review runs, including successes              | `operation/jobs/v1`: `searchJobExecutions`; `job-execution-review` snippet                             |
+| Inspect steps and exact log path              | `operation/jobs/v1`: `getJobExecution`; `job-execution-inspect` snippet                                |
+| Investigate failures with detail reads        | `failed-job-triage` snippet; [jobs](references/jobs.md)                                                |
+| Start a job / stop an execution               | `operation/jobs/v1`: `createJobExecution` / `deleteJobExecution`; confirm intent and active runs first |
+| Active/rollback versions, activation metadata | `dx/scripts/v1`: `getCodeVersions`; `code-version-inspect` snippet                                     |
+| Activate/create/delete a code version         | `dx/scripts/v1`: `updateCodeVersion` / `createCodeVersion` / `deleteCodeVersion`                       |
+| Site status, catalog, ordered cartridge path  | `site/sites/v1`: `getSiteById`; `site-cartridge-inspect` snippet                                       |
+| Change a site's custom cartridge path         | `site/sites/v1`: `replaceSiteCustomCartridges`; preserve order and unrelated entries                   |
+| Basic product + optional category assignment  | `create-product` snippet; [products](references/products.md)                                           |
+| Campaign assignments and promotion details    | `campaign-promotions` snippet; [promotions](references/promotions.md)                                  |
 
 File content is WebDAV: `webdav_list` / `webdav_get` / `webdav_put`.
 Deploy local cartridge files with `cartridge_deploy`. Job schedules/definitions
@@ -115,16 +115,48 @@ These are conditional setup references, not additional prerequisite reads.
   no program replay or automatic cleanup deletion.
 - Filter/page at the API, then project/aggregate in code. Include IDs, verification
   fields, errors, totals, and continuation inputs. Do not crop away missing data.
-- Limits: 20 calls, four concurrent, 30 seconds, 24 KB returned. Narrow oversized
+- Limits: 20 calls, four outstanding, 30 seconds of active execution, 24 KB returned.
+  Managed API/token calls are serialized within an execution. Narrow oversized
   discovery; reduce live pages/projections.
 - SDK safety applies per request, including POST searches. Use only authorized
-  targeted exceptions. Confirmation-required requests stop. Code mode does not
+  targeted exceptions. Confirmation uses client elicitation; see below. Code mode does not
   transfer binaries; use WebDAV tools for instance files, an external client for
   binary SCAPI endpoints.
 - `fetch` and `WebSocket` are disabled. Use `scapi.request()` inside programs;
   direct HTTP belongs in an external client, outside MCP Safety Mode. Do not use
   imports or other Node networking APIs to bypass this boundary.
 
+## Confirmation and cancellation
+
+- A request requiring approval retains the running program and returns MCP
+  `input_required`. Let the client handle elicitation and the protocol retry;
+  never manufacture approval responses or modify opaque `requestState`.
+- Retries validate the original code, input, and target arguments, then resume
+  the same execution. Repeated code is **not evaluated again**. Each request
+  needs its own approval; a whole program is not a transaction.
+- Later managed calls wait for the pending decision. Earlier writes remain
+  applied. Prompts identify the organization, operation, method/path, and execution
+  ID. JSON previews are redacted and capped at five lines/400 characters; marked
+  truncation does not limit approval, which covers the full request.
+  Results include operation outcomes; `unknown` requires
+  checking the affected records before a fresh attempt.
+- Decline/cancel terminates the entire execution, even if code catches errors.
+  Explicitly stop work with `scapi_execute({action: "cancel", executionId, skillRead: true})`;
+  omit code, input, project overrides, and protocol continuation state.
+- Approval has no server deadline; waiting does not consume the active runtime
+  budget. At most four executions may be active per server, including pending
+  approvals. Cancel unwanted work to free a slot. Server shutdown or disconnect
+  releases retained workers; state does not survive a restart. Clients may impose
+  their own timeout. Duplicate responses never replay code or send a request twice.
+- To change code/input/target, cancel unwanted retained work and start a fresh
+  execution without continuation state. Cancellation does not roll back writes.
+  Clients without form elicitation stop at confirmation-required requests.
+
+For safety levels, rule matching, configuration precedence, and confirmation
+semantics, read `docs_read({query: "guide-safety"})` when needed. If docs tools
+are unavailable, use the [Safety Mode guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/safety.md).
+This is an optional policy reference, not another prerequisite read.
+
 ## Reusable workflows
 
 Find workflows with `codemode.search(query)`; `codemode.describe(name)`

package/dist/guidance.js

@@ -36,8 +36,6 @@ const inputSchema = {
 const collectionSchema = z.object({
     id: z.string(),
     title: z.string(),
-    isGA: z.boolean(),
-    workspaces: z.array(z.string()).optional(),
 });
 const pageFields = {
     collections: z.array(collectionSchema),

package/dist/registry.js

@@ -40,7 +40,7 @@ export function createToolRegistry(loadServices, serverContext, detectedWorkspac
         ...createDiagnosticsTools(loadServices, serverContext),
         ...createDocsTools(loadServices, { detectedWorkspaces, enabledCategories: enabledDocCategories }),
         ...createMrtTools(loadServices),
-        ...createScapiTools(loadServices),
+        ...createScapiTools(loadServices, serverContext?.scapiExecutions),
         createGuidanceTool(),
     ];
     // Organize tools by their declared toolsets (supports multi-toolset)

package/dist/server-context.d.ts

@@ -1,6 +1,7 @@
 import { LogWatchRegistry } from './tools/diagnostics/log-watch-registry.js';
 import { MrtLogWatchRegistry } from './tools/diagnostics/mrt-log-watch-registry.js';
 import { DebugSessionRegistry } from './tools/diagnostics/session-registry.js';
+import { ScapiExecutionRegistry } from './tools/scapi/execution-registry.js';
 /**
  * Server-scoped persistent state that lives for the lifetime of the MCP
  * server process. Holds registries for stateful resources (debug sessions,
@@ -27,6 +28,7 @@ export declare class ServerContext {
     readonly debugSessions: DebugSessionRegistry;
     readonly logWatches: LogWatchRegistry;
     readonly mrtLogWatches: MrtLogWatchRegistry;
+    readonly scapiExecutions: ScapiExecutionRegistry;
     constructor();
     destroyAll(): Promise<void>;
 }

package/dist/server-context.js

@@ -6,6 +6,7 @@
 import { LogWatchRegistry } from './tools/diagnostics/log-watch-registry.js';
 import { MrtLogWatchRegistry } from './tools/diagnostics/mrt-log-watch-registry.js';
 import { DebugSessionRegistry } from './tools/diagnostics/session-registry.js';
+import { ScapiExecutionRegistry } from './tools/scapi/execution-registry.js';
 /**
  * Server-scoped persistent state that lives for the lifetime of the MCP
  * server process. Holds registries for stateful resources (debug sessions,
@@ -32,16 +33,19 @@ export class ServerContext {
     debugSessions;
     logWatches;
     mrtLogWatches;
+    scapiExecutions;
     constructor() {
         this.debugSessions = new DebugSessionRegistry();
         this.logWatches = new LogWatchRegistry();
         this.mrtLogWatches = new MrtLogWatchRegistry();
+        this.scapiExecutions = new ScapiExecutionRegistry();
     }
     async destroyAll() {
         await Promise.allSettled([
             this.debugSessions.destroyAll(),
             this.logWatches.destroyAll(),
             this.mrtLogWatches.destroyAll(),
+            this.scapiExecutions.destroyAll(),
         ]);
     }
 }

package/dist/server.d.ts

@@ -2,7 +2,7 @@ import { McpServer } from '@modelcontextprotocol/server';
 import type { CallToolResult, Implementation, ReadResourceResult, ToolAnnotations, ServerOptions, Transport } from '@modelcontextprotocol/server';
 import { type ZodRawShape } from 'zod';
 import type { Telemetry } from '@salesforce/b2c-tooling-sdk/telemetry';
-import type { McpToolConfig } from './utils/types.js';
+import type { McpToolConfig, ToolContext } from './utils/types.js';
 /**
  * Extended server options.
  */
@@ -45,9 +45,7 @@ export declare class B2CDxMcpServer extends McpServer {
      * @param inputSchema - Zod schema for input validation
      * @param handler - Function to handle tool invocations
      */
-    addTool(name: string, description: string, inputSchema: ZodRawShape, handler: (args: Record<string, unknown>, context?: {
-        signal?: AbortSignal;
-    }) => Promise<CallToolResult>, metadata?: Pick<McpToolConfig, 'outputSchema' | 'title'> & {
+    addTool(name: string, description: string, inputSchema: ZodRawShape, handler: (args: Record<string, unknown>, context?: ToolContext) => Promise<CallToolResult>, metadata?: Pick<McpToolConfig, 'outputSchema' | 'title'> & {
         annotations?: ToolAnnotations;
     }): void;
     close(): Promise<void>;

package/dist/server.js

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: Apache-2
  * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
  */
-import { McpServer, ProtocolError, ProtocolErrorCode, CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY, } from '@modelcontextprotocol/server';
+import { McpServer, ProtocolError, ProtocolErrorCode, CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY, CLIENT_CAPABILITIES_META_KEY, } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { getLogger } from '@salesforce/b2c-tooling-sdk/logging';
 /**
@@ -25,7 +25,11 @@ export class B2CDxMcpServer extends McpServer {
      */
     constructor(serverInfo, options) {
         const { cleanup, telemetry, ...serverOptions } = options ?? {};
-        super(serverInfo, serverOptions);
+        // The bundled SDK patch supports zero for human-paced approval with no server deadline.
+        super(serverInfo, {
+            ...serverOptions,
+            inputRequired: { maxRounds: 20, roundTimeoutMs: 0, ...serverOptions.inputRequired },
+        });
         this.cleanup = cleanup;
         this.telemetry = telemetry;
         // Set up oninitialized handler
@@ -70,7 +74,16 @@ export class B2CDxMcpServer extends McpServer {
                 this.telemetry?.addAttributes({ clientName: clientInfo.name, clientVersion: clientInfo.version });
             const startTime = Date.now();
             try {
-                const result = await handler(args, { signal: context.mcpReq?.signal });
+                const envelope = context.mcpReq?.envelope;
+                const capabilities = envelope?.[CLIENT_CAPABILITIES_META_KEY] ?? this.server.getClientCapabilities();
+                const elicitation = capabilities?.elicitation;
+                const result = await handler(args, {
+                    signal: context.mcpReq?.signal,
+                    requestState: context.mcpReq?.requestState?.(),
+                    inputResponses: context.mcpReq?.inputResponses,
+                    supportsElicitation: elicitation !== undefined && (elicitation.form !== undefined || Object.keys(elicitation).length === 0),
+                    keepCancellation: !envelope?.[PROTOCOL_VERSION_META_KEY],
+                });
                 const runTimeMs = Date.now() - startTime;
                 // Extract error message from CallToolResult content when isError is true
                 const errorMessage = result.isError ? result.content?.find((c) => c.type === 'text')?.text : undefined;