@salesforce/b2c-dx-mcp 3.1.0 → 3.1.2

package/content/guidance/b2c-cli/b2c-docs/SKILL.md

@@ -17,7 +17,7 @@ Use the `b2c` CLI to search and read B2C Commerce documentation spanning multipl
 
 - **Multi-corpus search** — Search across Script API, Developer Center guides, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
 - **Workspace-aware search** — Auto-detects project type (cartridges, SFRA, PWA Kit, Storefront Next) and boosts relevant documentation while de-boosting competing storefront frameworks
-- **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`)
+- **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`, `help-kb`)
 - **Triage metadata** — Search results include `category`, `summary`, `keywords`, and `url` to help identify the right match without reading full content
 - **Online content with local cache** — Script API, Developer Center guides, and Salesforce Help are fetched online when you read them and cached locally (memory + on-disk, 7-day TTL) so repeat reads avoid the network; graceful offline fallback shows the summary + headings + both URLs
 - **Content-aware ranking** — BM25-style search indexes titles, section headings, summaries, and keywords for better recall on conceptual questions
@@ -54,6 +54,9 @@ b2c docs search "site import export" --category help-admin
 # Search Salesforce Help — merchandising (catalogs, promotions, search, pricing)
 b2c docs search "price book assignment" --category help-merchant
 
+# Search Salesforce Help Knowledge Articles — troubleshooting, known issues, how-to answers
+b2c docs search "code upload certificate hyperforce" --category help-kb
+
 # Search tooling documentation
 b2c docs search "authentication setup" --category tooling
 b2c docs search "import set" --category tooling
@@ -153,6 +156,7 @@ b2c docs read pwa-kit-managed-runtime/getting-started
 # Read Salesforce Help articles by namespaced ID
 b2c docs read help-admin/b2c_site_import_export
 b2c docs read help-merchant/b2c_creating_price_books
+b2c docs read help-kb/002772125
 
 # Read tooling guides
 b2c docs read guide-authentication
@@ -239,10 +243,11 @@ xmllint --schema "$(b2c docs schema catalog --path)" my-catalog.xml --noout
 | `job-step`                | Standard (system) job step catalog                                                                                               | `ImportCatalog`, `ExportCatalog`, `job-steps`       |
 | `help-admin`              | Salesforce Help — administration/ops (import/export, jobs, replication, security, Account Manager, permissions, logs, inventory) | `help-admin/b2c_site_import_export`                 |
 | `help-merchant`           | Salesforce Help — merchandising (catalogs, products, promotions, search, content, analytics, SEO)                                | `help-merchant/b2c_creating_price_books`            |
+| `help-kb`                 | Salesforce Help Knowledge Articles — troubleshooting, known issues, and how-to answers (keyed by article number)                 | `help-kb/002772125`                                 |
 
-> **URLs:** All categories except `job-step` carry both `url` (human .html page) and `sourceUrl` (machine-readable .md). For `help-admin`/`help-merchant`, `url` is the live help.salesforce.com article and content is read from `sourceUrl`. `job-step` entries have neither (content is bundled inline).
+> **URLs:** All categories except `job-step` carry both `url` (human .html page) and `sourceUrl` (machine-readable .md). For `help-admin`/`help-merchant`/`help-kb`, `url` is the live help.salesforce.com article and content is read from `sourceUrl`. `job-step` entries have neither (content is bundled inline).
 >
-> **Caching:** Content for the online corpora (`script-api`, the guide categories, `help-admin`/`help-merchant`, `tooling`) is fetched on `docs read` and cached locally. Use `b2c docs cache` to inspect it and `b2c docs cache --clear` to purge it (forces a re-fetch).
+> **Caching:** Content for the online corpora (`script-api`, the guide categories, `help-admin`/`help-merchant`/`help-kb`, `tooling`) is fetched on `docs read` and cached locally. Use `b2c docs cache` to inspect it and `b2c docs cache --clear` to purge it (forces a re-fetch).
 
 ## Common Script API Classes
 

package/content/guidance/b2c-cli/b2c-ecdn/SKILL.md

@@ -60,10 +60,10 @@ b2c ecdn cache purge --zone my-zone --tag product-123 --tag category-456
 b2c ecdn certificates list --zone my-zone
 
 # add a new certificate
-b2c ecdn certificates add --zone my-zone --hostname www.example.com --certificate-file ./cert.pem --private-key-file ./key.pem
+b2c ecdn certificates add --zone my-zone --hostname www.example.com --type custom --certificate-file ./cert.pem --private-key-file ./key.pem
 
 # validate a custom hostname
-b2c ecdn certificates validate --zone my-zone --certificate-id abc123
+b2c ecdn certificates validate --zone my-zone --custom-hostname-id abc123
 ```
 
 ### Manage Rate Limiting Rules
@@ -92,7 +92,7 @@ b2c ecdn rate-limit delete --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701a
 b2c ecdn security get --zone my-zone
 
 # update security settings
-b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --always-use-https
+b2c ecdn security update --zone my-zone --security-level medium --always-use-https --tls13
 ```
 
 ### Speed Settings
@@ -102,7 +102,7 @@ b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --
 b2c ecdn speed get --zone my-zone
 
 # update speed settings
-b2c ecdn speed update --zone my-zone --browser-cache-ttl 14400 --auto-minify-html --auto-minify-css
+b2c ecdn speed update --zone my-zone --brotli on --http3 on --webp on
 ```
 
 ## Additional Topics

package/content/guidance/b2c-cli/b2c-ecdn/references/ADVANCED.md

@@ -41,17 +41,32 @@ b2c ecdn mrt-rules delete --zone my-zone
 
 ## mTLS Certificates
 
+Code upload certificates enable two-factor (mTLS) code upload to staging instances (`_stg` tenants only). There are two kinds: CAs registered with eCDN for the tenant (typically one, but several can be active, e.g. during renewal), which only sign certificates; and client certificates (`.p12`) signed by a CA (typically one per CI pipeline or developer, any number allowed), which the CLI sends on code upload. CI pipelines are the primary use case. Use `create --generate --name <ca-label> --client-name <pipeline>` once to create + register the CA and issue the first (CI) client cert, then `issue` for each additional pipeline/developer. `setup` is a guided, interactive version of `create --generate` with defaults and an optional dw.json update. `create` with `--certificate-file`/`--private-key-file` registers a bring-your-own CA. The code upload hostname is provisioned by Salesforce and linked automatically; users don't configure it. The CA private key must be kept secret (treat like a password); the CA certificate bundle must have a maximum validity of 1 year and be renewed before expiry. On Hyperforce, use the `staging-<realm>-<customer>.demandware.net` code upload hostname (not legacy `cert.staging.*`).
+
+For the complete workflow, security guidance, and renewal instructions, see [Deploying to Hyperforce: Set Up Two-Factor Code Upload](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/hyperforce#set-up-two-factor-code-upload).
+
 ```bash
-# list mTLS certificates (organization level)
-b2c ecdn mtls list
+# typically once per tenant: generate + register CA, issue first client cert (e.g. for CI)
+b2c ecdn mtls create --name code-upload --generate --client-name github-actions
+b2c ecdn mtls create --name code-upload --generate --out-dir ./certs --client-name github-actions
+
+# guided/interactive version of create --generate (prompts, defaults, optional dw.json update)
+b2c ecdn mtls setup
 
-# create mTLS certificate for code upload authentication
-b2c ecdn mtls create --name "Build Server" --ca-certificate-file ./ca.pem --leaf-certificate-file ./leaf.pem
+# upload an existing CA
+b2c ecdn mtls create --name code-upload --certificate-file ./ca.pem --private-key-file ./ca.key
+
+# issue a client certificate per CI pipeline / developer (local-only, no API call)
+b2c ecdn mtls issue --ca-cert-file ./certs/ca.pem --ca-key-file ./certs/ca.key --name jane.doe
+b2c ecdn mtls issue --ca-cert-file ca.pem --ca-key-file ca.key --name ci --output ci.p12 --days 90
+
+# list uploaded CA certificates
+b2c ecdn mtls list
 
-# get mTLS certificate details
+# get certificate details
 b2c ecdn mtls get --certificate-id abc123
 
-# delete mTLS certificate
+# delete a CA certificate (uploaded CA stops accepting client certs)
 b2c ecdn mtls delete --certificate-id abc123
 ```
 

package/content/guidance/b2c-cli/b2c-ecdn/references/SECURITY.md

@@ -33,10 +33,10 @@ b2c ecdn waf migrate --zone my-zone
 b2c ecdn firewall list --zone my-zone
 
 # create a firewall rule
-b2c ecdn firewall create --zone my-zone --description "Block bad bots" --action block --filter '(cf.client.bot)'
+b2c ecdn firewall create --zone my-zone --description "Block bad bots" --expression '(cf.client.bot)' --actions block
 
 # update a firewall rule
-b2c ecdn firewall update --zone my-zone --rule-id abc123 --action challenge
+b2c ecdn firewall update --zone my-zone --rule-id abc123 --actions managed_challenge
 
 # reorder firewall rules
 b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3
@@ -49,7 +49,7 @@ b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3
 b2c ecdn rate-limit list --zone my-zone
 
 # create a rate limiting rule
-b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --threshold 100 --period 60 --action block --match-url '/api/*'
+b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --expression '(http.request.uri.path matches "^/api/")' --characteristics cf.unique_visitor_id --action block --period 60 --requests-per-period 100 --mitigation-timeout 600
 
 # delete a rate limiting rule
 b2c ecdn rate-limit delete --zone my-zone --rule-id abc123
@@ -62,7 +62,7 @@ b2c ecdn rate-limit delete --zone my-zone --rule-id abc123
 b2c ecdn page-shield notifications list
 
 # create a notification webhook
-b2c ecdn page-shield notifications create --url https://example.com/webhook --secret my-secret --zones zone1,zone2
+b2c ecdn page-shield notifications create --webhook-url https://example.com/webhook --secret my-secret --zones zone1,zone2
 
 # list Page Shield policies (zone level)
 b2c ecdn page-shield policies list --zone my-zone

package/content/guidance/index.json

@@ -178,7 +178,7 @@
       "files": [
         {
           "path": "SKILL.md",
-          "bytes": 17299
+          "bytes": 17746
         }
       ]
     },
@@ -193,15 +193,15 @@
       "files": [
         {
           "path": "references/ADVANCED.md",
-          "bytes": 2420
+          "bytes": 4533
         },
         {
           "path": "references/SECURITY.md",
-          "bytes": 2082
+          "bytes": 2213
         },
         {
           "path": "SKILL.md",
-          "bytes": 4881
+          "bytes": 4863
         }
       ]
     },

package/dist/commands/mcp.js

@@ -200,7 +200,7 @@ export default class McpServerCommand extends BaseCommand {
         'docs-topics': Flags.string({
             description: 'Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). ' +
                 'Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, tooling, ' +
-                'help-admin, help-merchant. ' +
+                'help-admin, help-merchant, help-kb. ' +
                 'Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.',
             env: 'SFCC_DOCS_TOPICS',
         }),

package/dist/services.d.ts

@@ -19,8 +19,8 @@
  *
  * ## Resolution Pattern
  *
- * Both B2CInstance and MRT auth are resolved once at server startup (not on each tool call).
- * This provides fail-fast behavior and consistent performance.
+ * B2C instance and MRT auth are resolved for each tool call, so edits to project
+ * configuration are picked up without restarting the server.
  *
  * **B2C Instance** (for WebDAV/OCAPI tools):
  * - Flags (highest priority) merged with dw.json (auto-discovered or via --config)
@@ -39,7 +39,7 @@
 import fs from 'node:fs';
 import type { B2CInstance } from '@salesforce/b2c-tooling-sdk';
 import type { AuthStrategy } from '@salesforce/b2c-tooling-sdk/auth';
-import type { ResolvedB2CConfig } from '@salesforce/b2c-tooling-sdk/config';
+import { type ResolvedB2CConfig } from '@salesforce/b2c-tooling-sdk/config';
 import type { ConfigurationResolutionSource, ProjectDirectoryInfo, ToolResolution } from './tools/project-context.js';
 import { WebDavClient, type CustomApisClient, type MetricsClient, type ScapiSchemasClient } from '@salesforce/b2c-tooling-sdk/clients';
 /**
@@ -101,13 +101,13 @@ export interface ServicesResolutionInputs {
 export declare class Services {
     /**
      * Pre-resolved B2C instance for WebDAV/OCAPI operations.
-     * Resolved once at server startup from InstanceCommand flags and dw.json.
+     * Resolved for this tool call from server flags and project configuration.
      * Undefined if no B2C instance configuration was available.
      */
     readonly b2cInstance?: B2CInstance;
     /**
      * Pre-resolved MRT configuration (auth, project, environment, origin).
-     * Resolved once at server startup from MrtCommand flags and ~/.mobify.
+     * Resolved for this tool call from server flags and MRT configuration.
      */
     readonly mrtConfig: MrtConfig;
     /**
@@ -310,6 +310,8 @@ export declare class Services {
      * @returns Resolved absolute path
      */
     resolveWithProjectDirectory(pathArg?: string, projectDirectoryOverride?: string): string;
+    /** Run a tool with its resolved safety policy, without changing other calls. */
+    runWithSafety<T>(callback: () => T): T;
     /**
      * Get file or directory stats.
      *

package/dist/services.js

@@ -24,8 +24,8 @@
  *
  * ## Resolution Pattern
  *
- * Both B2CInstance and MRT auth are resolved once at server startup (not on each tool call).
- * This provides fail-fast behavior and consistent performance.
+ * B2C instance and MRT auth are resolved for each tool call, so edits to project
+ * configuration are picked up without restarting the server.
  *
  * **B2C Instance** (for WebDAV/OCAPI tools):
  * - Flags (highest priority) merged with dw.json (auto-discovered or via --config)
@@ -44,7 +44,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { createCustomApisClient, createMetricsClient, createScapiSchemasClient, toOrganizationId, WebDavClient, } from '@salesforce/b2c-tooling-sdk/clients';
+import { getB2CConfigDirectory } from '@salesforce/b2c-tooling-sdk/config';
+import { SafetyGuard, resolveEffectiveSafetyConfig, loadGlobalSafetyConfig } from '@salesforce/b2c-tooling-sdk/safety';
+import { createCustomApisClient, createMetricsClient, createScapiSchemasClient, toOrganizationId, WebDavClient, globalMiddlewareRegistry, createSafetyMiddleware, } from '@salesforce/b2c-tooling-sdk/clients';
 function createToolResolution(config, inputs) {
     const configuredProjectDirectory = config.values.projectDirectory;
     const projectDirectory = inputs?.projectDirectory ??
@@ -87,13 +89,13 @@ function createToolResolution(config, inputs) {
 export class Services {
     /**
      * Pre-resolved B2C instance for WebDAV/OCAPI operations.
-     * Resolved once at server startup from InstanceCommand flags and dw.json.
+     * Resolved for this tool call from server flags and project configuration.
      * Undefined if no B2C instance configuration was available.
      */
     b2cInstance;
     /**
      * Pre-resolved MRT configuration (auth, project, environment, origin).
-     * Resolved once at server startup from MrtCommand flags and ~/.mobify.
+     * Resolved for this tool call from server flags and MRT configuration.
      */
     mrtConfig;
     /**
@@ -339,9 +341,6 @@ export class Services {
     listDirectory(dirPath) {
         return fs.readdirSync(dirPath, { withFileTypes: true });
     }
-    // ============================================
-    // SCAPI Helper Methods
-    // ============================================
     /**
      * Read a file from the filesystem.
      *
@@ -352,6 +351,9 @@ export class Services {
     readFile(filePath, encoding = 'utf8') {
         return fs.readFileSync(filePath, { encoding });
     }
+    // ============================================
+    // SCAPI Helper Methods
+    // ============================================
     /**
      * Resolve a path relative to the current working directory.
      *
@@ -414,6 +416,15 @@ export class Services {
         }
         return path.resolve(projectDir, pathArg);
     }
+    /** Run a tool with its resolved safety policy, without changing other calls. */
+    runWithSafety(callback) {
+        const environment = Object.fromEntries(['SFCC_SAFETY_LEVEL', 'SFCC_SAFETY_CONFIRM', 'SFCC_SAFETY_CONFIG'].map((name) => [
+            name,
+            this.getEnvironmentVariable(name),
+        ]));
+        const guard = new SafetyGuard(resolveEffectiveSafetyConfig(this.resolvedConfig.values.safety, loadGlobalSafetyConfig(getB2CConfigDirectory(), environment, this.resolution.projectDirectory.path), environment));
+        return globalMiddlewareRegistry.runWithOverrides([{ name: 'cli-safety-guard', getMiddleware: () => createSafetyMiddleware(guard) }], callback);
+    }
     /**
      * Get file or directory stats.
      *

package/dist/tools/adapter.js

@@ -271,7 +271,7 @@ export function createToolAdapter(options, loadServices, serverContext) {
                         executionResolution.directories[name] = value;
                     },
                 };
-                const output = await execute(args, context);
+                const output = await services.runWithSafety(() => execute(args, context));
                 // 6. Format output
                 const result = formatOutput(output);
                 return resolution ? attachResolution(result, executionResolution) : result;

package/node_modules/@salesforce/b2c-agent-plugins/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @salesforce/b2c-agent-plugins
 
+## 1.10.2
+
+### Patch Changes
+
+- [#717](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/717) [`443fa0b`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/443fa0b9bd0abdd360077c51b692784eaa1827dd) - Clearer Hyperforce two-factor code upload guidance: a step-by-step setup that starts with CI pipelines, plus clearer `b2c ecdn mtls` prompts that separate the CA from the client certificate used for upload (Thanks [@clavery](https://github.com/clavery)!)
+
+## 1.10.1
+
+### Patch Changes
+
+- [#713](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/713) [`b9972c9`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/b9972c9b9db69b2b2b7c2229250d9aa9b4c665e3) - Added Salesforce Help Knowledge Articles for B2C Commerce — troubleshooting, known issues, and how-to answers (administration: 135, developer support: 92, merchandising: 89, operations and security: 29, performance: 20, Composable Storefront: 16) — as a new `help-kb` docs category, available in the `b2c docs` CLI and MCP docs tools. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#711](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/711) [`c6ed31d`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c6ed31d3f71553e1fb921c7e4106fb81086afb7d) - Updated the eCDN skill to cover the new code upload certificate workflow and fixed outdated flags in its certificate, security, speed, firewall, rate limit, and Page Shield examples. (Thanks [@clavery](https://github.com/clavery)!)
+
 ## 1.10.0
 
 ### Minor Changes

package/node_modules/@salesforce/b2c-agent-plugins/b2c/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C Commerce development skills including Custom API development guides.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C Commerce development skills including Custom API development guides.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c-cli",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C CLI Skills for Salesforce Commerce Cloud development.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c-cli",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C CLI Skills for Salesforce Commerce Cloud development.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-docs/SKILL.md

@@ -17,7 +17,7 @@ Use the `b2c` CLI to search and read B2C Commerce documentation spanning multipl
 
 - **Multi-corpus search** — Search across Script API, Developer Center guides, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
 - **Workspace-aware search** — Auto-detects project type (cartridges, SFRA, PWA Kit, Storefront Next) and boosts relevant documentation while de-boosting competing storefront frameworks
-- **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`)
+- **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`, `help-kb`)
 - **Triage metadata** — Search results include `category`, `summary`, `keywords`, and `url` to help identify the right match without reading full content
 - **Online content with local cache** — Script API, Developer Center guides, and Salesforce Help are fetched online when you read them and cached locally (memory + on-disk, 7-day TTL) so repeat reads avoid the network; graceful offline fallback shows the summary + headings + both URLs
 - **Content-aware ranking** — BM25-style search indexes titles, section headings, summaries, and keywords for better recall on conceptual questions
@@ -54,6 +54,9 @@ b2c docs search "site import export" --category help-admin
 # Search Salesforce Help — merchandising (catalogs, promotions, search, pricing)
 b2c docs search "price book assignment" --category help-merchant
 
+# Search Salesforce Help Knowledge Articles — troubleshooting, known issues, how-to answers
+b2c docs search "code upload certificate hyperforce" --category help-kb
+
 # Search tooling documentation
 b2c docs search "authentication setup" --category tooling
 b2c docs search "import set" --category tooling
@@ -153,6 +156,7 @@ b2c docs read pwa-kit-managed-runtime/getting-started
 # Read Salesforce Help articles by namespaced ID
 b2c docs read help-admin/b2c_site_import_export
 b2c docs read help-merchant/b2c_creating_price_books
+b2c docs read help-kb/002772125
 
 # Read tooling guides
 b2c docs read guide-authentication
@@ -239,10 +243,11 @@ xmllint --schema "$(b2c docs schema catalog --path)" my-catalog.xml --noout
 | `job-step`                | Standard (system) job step catalog                                                                                               | `ImportCatalog`, `ExportCatalog`, `job-steps`       |
 | `help-admin`              | Salesforce Help — administration/ops (import/export, jobs, replication, security, Account Manager, permissions, logs, inventory) | `help-admin/b2c_site_import_export`                 |
 | `help-merchant`           | Salesforce Help — merchandising (catalogs, products, promotions, search, content, analytics, SEO)                                | `help-merchant/b2c_creating_price_books`            |
+| `help-kb`                 | Salesforce Help Knowledge Articles — troubleshooting, known issues, and how-to answers (keyed by article number)                 | `help-kb/002772125`                                 |
 
-> **URLs:** All categories except `job-step` carry both `url` (human .html page) and `sourceUrl` (machine-readable .md). For `help-admin`/`help-merchant`, `url` is the live help.salesforce.com article and content is read from `sourceUrl`. `job-step` entries have neither (content is bundled inline).
+> **URLs:** All categories except `job-step` carry both `url` (human .html page) and `sourceUrl` (machine-readable .md). For `help-admin`/`help-merchant`/`help-kb`, `url` is the live help.salesforce.com article and content is read from `sourceUrl`. `job-step` entries have neither (content is bundled inline).
 >
-> **Caching:** Content for the online corpora (`script-api`, the guide categories, `help-admin`/`help-merchant`, `tooling`) is fetched on `docs read` and cached locally. Use `b2c docs cache` to inspect it and `b2c docs cache --clear` to purge it (forces a re-fetch).
+> **Caching:** Content for the online corpora (`script-api`, the guide categories, `help-admin`/`help-merchant`/`help-kb`, `tooling`) is fetched on `docs read` and cached locally. Use `b2c docs cache` to inspect it and `b2c docs cache --clear` to purge it (forces a re-fetch).
 
 ## Common Script API Classes
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/SKILL.md

@@ -60,10 +60,10 @@ b2c ecdn cache purge --zone my-zone --tag product-123 --tag category-456
 b2c ecdn certificates list --zone my-zone
 
 # add a new certificate
-b2c ecdn certificates add --zone my-zone --hostname www.example.com --certificate-file ./cert.pem --private-key-file ./key.pem
+b2c ecdn certificates add --zone my-zone --hostname www.example.com --type custom --certificate-file ./cert.pem --private-key-file ./key.pem
 
 # validate a custom hostname
-b2c ecdn certificates validate --zone my-zone --certificate-id abc123
+b2c ecdn certificates validate --zone my-zone --custom-hostname-id abc123
 ```
 
 ### Manage Rate Limiting Rules
@@ -92,7 +92,7 @@ b2c ecdn rate-limit delete --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701a
 b2c ecdn security get --zone my-zone
 
 # update security settings
-b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --always-use-https
+b2c ecdn security update --zone my-zone --security-level medium --always-use-https --tls13
 ```
 
 ### Speed Settings
@@ -102,7 +102,7 @@ b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --
 b2c ecdn speed get --zone my-zone
 
 # update speed settings
-b2c ecdn speed update --zone my-zone --browser-cache-ttl 14400 --auto-minify-html --auto-minify-css
+b2c ecdn speed update --zone my-zone --brotli on --http3 on --webp on
 ```
 
 ## Additional Topics

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/references/ADVANCED.md

@@ -41,17 +41,32 @@ b2c ecdn mrt-rules delete --zone my-zone
 
 ## mTLS Certificates
 
+Code upload certificates enable two-factor (mTLS) code upload to staging instances (`_stg` tenants only). There are two kinds: CAs registered with eCDN for the tenant (typically one, but several can be active, e.g. during renewal), which only sign certificates; and client certificates (`.p12`) signed by a CA (typically one per CI pipeline or developer, any number allowed), which the CLI sends on code upload. CI pipelines are the primary use case. Use `create --generate --name <ca-label> --client-name <pipeline>` once to create + register the CA and issue the first (CI) client cert, then `issue` for each additional pipeline/developer. `setup` is a guided, interactive version of `create --generate` with defaults and an optional dw.json update. `create` with `--certificate-file`/`--private-key-file` registers a bring-your-own CA. The code upload hostname is provisioned by Salesforce and linked automatically; users don't configure it. The CA private key must be kept secret (treat like a password); the CA certificate bundle must have a maximum validity of 1 year and be renewed before expiry. On Hyperforce, use the `staging-<realm>-<customer>.demandware.net` code upload hostname (not legacy `cert.staging.*`).
+
+For the complete workflow, security guidance, and renewal instructions, see [Deploying to Hyperforce: Set Up Two-Factor Code Upload](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/hyperforce#set-up-two-factor-code-upload).
+
 ```bash
-# list mTLS certificates (organization level)
-b2c ecdn mtls list
+# typically once per tenant: generate + register CA, issue first client cert (e.g. for CI)
+b2c ecdn mtls create --name code-upload --generate --client-name github-actions
+b2c ecdn mtls create --name code-upload --generate --out-dir ./certs --client-name github-actions
+
+# guided/interactive version of create --generate (prompts, defaults, optional dw.json update)
+b2c ecdn mtls setup
 
-# create mTLS certificate for code upload authentication
-b2c ecdn mtls create --name "Build Server" --ca-certificate-file ./ca.pem --leaf-certificate-file ./leaf.pem
+# upload an existing CA
+b2c ecdn mtls create --name code-upload --certificate-file ./ca.pem --private-key-file ./ca.key
+
+# issue a client certificate per CI pipeline / developer (local-only, no API call)
+b2c ecdn mtls issue --ca-cert-file ./certs/ca.pem --ca-key-file ./certs/ca.key --name jane.doe
+b2c ecdn mtls issue --ca-cert-file ca.pem --ca-key-file ca.key --name ci --output ci.p12 --days 90
+
+# list uploaded CA certificates
+b2c ecdn mtls list
 
-# get mTLS certificate details
+# get certificate details
 b2c ecdn mtls get --certificate-id abc123
 
-# delete mTLS certificate
+# delete a CA certificate (uploaded CA stops accepting client certs)
 b2c ecdn mtls delete --certificate-id abc123
 ```
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-ecdn/references/SECURITY.md

@@ -33,10 +33,10 @@ b2c ecdn waf migrate --zone my-zone
 b2c ecdn firewall list --zone my-zone
 
 # create a firewall rule
-b2c ecdn firewall create --zone my-zone --description "Block bad bots" --action block --filter '(cf.client.bot)'
+b2c ecdn firewall create --zone my-zone --description "Block bad bots" --expression '(cf.client.bot)' --actions block
 
 # update a firewall rule
-b2c ecdn firewall update --zone my-zone --rule-id abc123 --action challenge
+b2c ecdn firewall update --zone my-zone --rule-id abc123 --actions managed_challenge
 
 # reorder firewall rules
 b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3
@@ -49,7 +49,7 @@ b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3
 b2c ecdn rate-limit list --zone my-zone
 
 # create a rate limiting rule
-b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --threshold 100 --period 60 --action block --match-url '/api/*'
+b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --expression '(http.request.uri.path matches "^/api/")' --characteristics cf.unique_visitor_id --action block --period 60 --requests-per-period 100 --mitigation-timeout 600
 
 # delete a rate limiting rule
 b2c ecdn rate-limit delete --zone my-zone --rule-id abc123
@@ -62,7 +62,7 @@ b2c ecdn rate-limit delete --zone my-zone --rule-id abc123
 b2c ecdn page-shield notifications list
 
 # create a notification webhook
-b2c ecdn page-shield notifications create --url https://example.com/webhook --secret my-secret --zones zone1,zone2
+b2c ecdn page-shield notifications create --webhook-url https://example.com/webhook --secret my-secret --zones zone1,zone2
 
 # list Page Shield policies (zone level)
 b2c ecdn page-shield policies list --zone my-zone

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c-ops",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c-ops",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/b2c-agent-plugins",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "B2C Commerce agent skills plugins for development and operations. Private — distributed via GitHub release zips.",
   "private": true
 }

package/node_modules/@salesforce/b2c-agent-plugins/storefront-next/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "storefront-next",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Storefront Next development skills for building React 19 storefronts on Salesforce B2C Commerce.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/storefront-next/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "storefront-next",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Storefront Next development skills for building React 19 storefronts on Salesforce B2C Commerce.",
   "author": {
     "name": "Salesforce"

package/oclif.manifest.json

@@ -444,7 +444,7 @@
           "type": "option"
         },
         "docs-topics": {
-          "description": "Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, tooling, help-admin, help-merchant. Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.",
+          "description": "Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, tooling, help-admin, help-merchant, help-kb. Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.",
           "env": "SFCC_DOCS_TOPICS",
           "name": "docs-topics",
           "hasDynamicHelp": false,
@@ -462,5 +462,5 @@
       "enableJsonFlag": false
     }
   },
-  "version": "3.1.0"
+  "version": "3.1.2"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/b2c-dx-mcp",
   "description": "MCP server for B2C Commerce developer experience tools",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "author": "Salesforce",
   "license": "Apache-2.0",
   "repository": "SalesforceCommerceCloud/b2c-developer-tooling",
@@ -80,8 +80,8 @@
     "ts-morph": "27.0.2",
     "yaml": "2.9.0",
     "zod": "4.5.4",
-    "@salesforce/b2c-agent-plugins": "1.10.0",
-    "@salesforce/b2c-tooling-sdk": "2.1.0"
+    "@salesforce/b2c-agent-plugins": "1.10.2",
+    "@salesforce/b2c-tooling-sdk": "2.2.0"
   },
   "bundledDependencies": [
     "@modelcontextprotocol/server",