@salesforce/b2c-dx-mcp 3.1.2 → 3.2.0

package/content/guidance/b2c-cli/b2c-config/SKILL.md

@@ -206,6 +206,29 @@ b2c setup ide tsserver-plugin --json
 
 The B2C DX VS Code extension needs no setup — it injects the same TypeScript Server plugin at runtime.
 
+## OpenShell Sandbox (Beta)
+
+`b2c setup openshell` creates an NVIDIA OpenShell sandbox from the resolved configuration. Secrets stay on the OpenShell gateway, and the sandbox can reach only the B2C hosts in use, at the configured Safety Mode level (or `NONE` if unset); Safety Mode rules carry over. Requires the `openshell` CLI with a running gateway, and Docker.
+
+```bash
+# Sandbox for the active instance at the configured Safety Mode level
+b2c setup openshell
+
+# Read-only sandbox
+b2c setup openshell --safety-level READ_ONLY
+
+# Allow writes but not deletes; include the MCP server
+b2c setup openshell --safety-level NO_DELETE --mcp
+
+# Write the policy, profiles, Dockerfile, and setup.sh without running anything
+b2c setup openshell --dry-run
+
+# Run a command in the sandbox
+openshell sandbox exec -n b2c-<instance> -- b2c code list
+```
+
+Edit `.openshell/<sandbox>/policy.yaml` and re-run to apply it; use `--recreate` after changing secrets or configuration. Add hosts with `--allow-host`. Only client credentials work in the sandbox (no browser login). See the [Agent Sandboxing guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/agent-sandboxing#openshell).
+
 ## Managing Instances
 
 ### List Configured Instances

package/content/guidance/b2c-cli/b2c-docs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: b2c-docs
-description: Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say "how do I implement passwordless login" or "what methods does Basket have" or "how do I deploy a PWA Kit bundle" or "how do I import a site archive" or "what SCAPI endpoints are available for checkout".
+description: Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce, OCAPI), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say "how do I implement passwordless login" or "what methods does Basket have" or "how do I deploy a PWA Kit bundle" or "how do I import a site archive" or "what SCAPI endpoints are available for checkout".
 ---
 
 # B2C Docs Skill
@@ -15,7 +15,7 @@ Use the `b2c` CLI to search and read B2C Commerce documentation spanning multipl
 
 ## Key Features
 
-- **Multi-corpus search** — Search across Script API, Developer Center guides, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
+- **Multi-corpus search** — Search across Script API, Developer Center guides, OCAPI reference, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
 - **Workspace-aware search** — Auto-detects project type (cartridges, SFRA, PWA Kit, Storefront Next) and boosts relevant documentation while de-boosting competing storefront frameworks
 - **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`, `help-kb`)
 - **Triage metadata** — Search results include `category`, `summary`, `keywords`, and `url` to help identify the right match without reading full content
@@ -114,7 +114,7 @@ The docs search understands which workspace framework your project uses and auto
 
 **Category boost mapping:**
 
-- Always relevant (any workspace): `b2c-commerce`, `tooling`
+- Always relevant (any workspace): `b2c-commerce`, `ocapi`, `tooling`
 - `cartridges` → `script-api`, `job-step`
 - `sfra` → `sfra`
 - `pwa-kit-v3` → `pwa-kit-managed-runtime`, `commerce-api`
@@ -239,6 +239,7 @@ xmllint --schema "$(b2c docs schema catalog --path)" my-catalog.xml --noout
 | `sfra`                    | Storefront Reference Architecture (SFRA) guides                                                                                  | `sfra/controllers-and-routes`                       |
 | `sfnext`                  | Storefront Next guides                                                                                                           | `sfnext/sfnext-get-started`                         |
 | `b2c-commerce`            | General B2C Commerce platform guides                                                                                             | `b2c-commerce/business-manager-overview`            |
+| `ocapi`                   | OCAPI reference — usage, hooks, settings, and best practices for the Open Commerce API                                           | `ocapi/ocapisettings`, `ocapi/bestpractices`        |
 | `tooling`                 | B2C CLI reference, guides, MCP docs, SDK guidance, and VS Code extension docs                                                    | `guide-authentication`, `cli-jobs`                  |
 | `job-step`                | Standard (system) job step catalog                                                                                               | `ImportCatalog`, `ExportCatalog`, `job-steps`       |
 | `help-admin`              | Salesforce Help — administration/ops (import/export, jobs, replication, security, Account Manager, permissions, logs, inventory) | `help-admin/b2c_site_import_export`                 |

package/content/guidance/b2c-cli/b2c-scapi-schemas/SKILL.md

@@ -9,10 +9,12 @@ Browse standard or tenant-specific SCAPI OpenAPI contracts.
 
 ## Tool choice
 
-When B2C MCP is available, prefer offline `scapi_search` for standard Admin and
-Shopper contracts. Read `skill://mcp/scapi/SKILL.md` via resource or `skills_read`
-first; pass `skillRead: true`. Discover method/path/operationId, then selected
-inputs and fields. No credentials or live Schemas API access needed.
+When B2C MCP is available, prefer `scapi_search` for Admin and Shopper contracts.
+Read `skill://mcp/scapi/SKILL.md` via resource or `skills_read` first; pass
+`skillRead: true`. Discover method/path/operationId, then selected inputs and
+fields. The default searches bundled standard contracts offline; `schemas: "live"`
+searches the tenant's contracts (custom attributes, custom APIs, newer APIs) and
+makes them callable from `scapi_execute`.
 
 Use `scapi_schemas_list` for live schemas, custom attributes, and custom APIs.
 For tenant fields, supply API family/name/version and `includeSchemas: true`.
@@ -20,9 +22,9 @@ Custom-property expansion defaults to true; `expandAll: true` preserves full def
 For large schemas, fetch/filter through code mode as described in the MCP SCAPI skill.
 Use `scapi_custom_apis_get_status` for registration status. Live schema access needs
 `sfcc.scapi-schemas`. Prefer a dedicated task tool for execution, otherwise
-`scapi_execute` supports Admin JSON calls with configured auth/scopes. For custom
+`scapi_execute` supports Admin and guest Shopper JSON calls with configured auth/scopes. For custom
 Admin endpoints, fetch the live contract through `scapi.request` in each program
-before calling it; follow the MCP SCAPI skill. Shopper and binary execution are
+before calling it; follow the MCP SCAPI skill. Registered-shopper and binary execution are
 unsupported. Use docs tools for semantics
 and limits rather than duplicating contract discovery.
 

package/content/guidance/index.json

@@ -129,11 +129,11 @@
       "description": "Configure B2C CLI/MCP authentication, instances, and project defaults; troubleshoot missing credentials, wrong targets, or configuration precedence. Routine inspection can use config_inspect or b2c setup inspect directly.",
       "entrypoint": "SKILL.md",
       "source": "skills/b2c-cli/skills/b2c-config/SKILL.md",
-      "headings": "B2C Config Skill | How the CLI Discovers Configuration | Storefront Next Environment Compatibility | Shared Global Default | MCP Project Context | `dw.json` Key Casing | Authentication | `--user-auth` Flag | Tenant ID and Organization ID | Inspecting Configuration | When to Use | View Current Configuration | Debug Sensitive Values | JSON Output for Scripting | IDE Integration | Managing Instances | List Configured Instances | Create a New Instance | Switch Active Instance | Remove an Instance | Understanding the Output | Configuration Priority | Project Defaults in package.json | Troubleshooting | Command says \"credentials required\" or \"client-id is required\" | Command targets the wrong instance | `dw.json` is not being picked up | 401/403 errors on SCAPI/OCAPI calls | Missing `tenantId` / `shortCode` | MRT commands say \"API key required\" | Sensitive values masked in `setup inspect` | Missing values | Wrong source taking precedence | Still stuck | Getting Admin OAuth Tokens | More Commands",
+      "headings": "B2C Config Skill | How the CLI Discovers Configuration | Storefront Next Environment Compatibility | Shared Global Default | MCP Project Context | `dw.json` Key Casing | Authentication | `--user-auth` Flag | Tenant ID and Organization ID | Inspecting Configuration | When to Use | View Current Configuration | Debug Sensitive Values | JSON Output for Scripting | IDE Integration | OpenShell Sandbox (Beta) | Managing Instances | List Configured Instances | Create a New Instance | Switch Active Instance | Remove an Instance | Understanding the Output | Configuration Priority | Project Defaults in package.json | Troubleshooting | Command says \"credentials required\" or \"client-id is required\" | Command targets the wrong instance | `dw.json` is not being picked up | 401/403 errors on SCAPI/OCAPI calls | Missing `tenantId` / `shortCode` | MRT commands say \"API key required\" | Sensitive values masked in `setup inspect` | Missing values | Wrong source taking precedence | Still stuck | Getting Admin OAuth Tokens | More Commands",
       "files": [
         {
           "path": "SKILL.md",
-          "bytes": 24384
+          "bytes": 25577
         }
       ]
     },
@@ -171,14 +171,14 @@
       "id": "b2c-cli/b2c-docs",
       "collection": "b2c-cli",
       "title": "b2c-docs",
-      "description": "Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say \"how do I implement passwordless login\" or \"what methods does Basket have\" or \"how do I deploy a PWA Kit bundle\" or \"how do I import a site archive\" or \"what SCAPI endpoints are available for checkout\".",
+      "description": "Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce, OCAPI), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say \"how do I implement passwordless login\" or \"what methods does Basket have\" or \"how do I deploy a PWA Kit bundle\" or \"how do I import a site archive\" or \"what SCAPI endpoints are available for checkout\".",
       "entrypoint": "SKILL.md",
       "source": "skills/b2c-cli/skills/b2c-docs/SKILL.md",
       "headings": "B2C Docs Skill | Key Features | Examples | Search Documentation | Workspace-Aware Search | Read Documentation | Standard Job Step Catalog | Download Documentation | Read XSD Schemas | Documentation Categories | Common Script API Classes | Common Schemas | More Commands",
       "files": [
         {
           "path": "SKILL.md",
-          "bytes": 17746
+          "bytes": 17996
         }
       ]
     },
@@ -349,7 +349,7 @@
         },
         {
           "path": "SKILL.md",
-          "bytes": 4103
+          "bytes": 4263
         }
       ]
     },
@@ -1366,7 +1366,7 @@
       "files": [
         {
           "path": "references/custom-apis.md",
-          "bytes": 2716
+          "bytes": 2734
         },
         {
           "path": "references/custom-properties.md",
@@ -1394,11 +1394,11 @@
         },
         {
           "path": "references/tokens.md",
-          "bytes": 2753
+          "bytes": 2764
         },
         {
           "path": "SKILL.md",
-          "bytes": 12530
+          "bytes": 14035
         }
       ],
       "featured": true

package/content/guidance/mcp/scapi/SKILL.md

@@ -17,8 +17,13 @@ then pass `skillRead: true`. This does not authorize mutations.
 
 ## Discover
 
-Discovery is offline; no credentials or Schemas API needed. Schemas and responses
-can be huge. Return only what the next decision needs:
+Discovery defaults to the bundled standard contracts offline; no credentials needed.
+Pass `schemas: "live"` to search the configured tenant's Schemas API contracts
+instead: tenant `c_*` properties, custom APIs, and APIs newer than the bundle.
+Live search needs `sfcc.scapi-schemas`, uses the same project context as
+`scapi_execute`, and caches per tenant for the server session (`refresh: true` refetches). Contracts that
+failed to load are listed in `schemaFailures`. Schemas and responses can be huge.
+Return only what the next decision needs:
 
 1. Find APIs/operations through `spec.apis`/`spec.paths`; return method/path/operationId.
 2. Narrow by `api`, path, or `authType`; inspect required inputs and selected fields,
@@ -55,24 +60,28 @@ Do not fall back to a terminal merely because there is no dedicated job/site too
 
 Bundled schemas omit tenant `c_*` definitions. Known custom fields can be sent
 directly in standard Admin bodies; schema retrieval is optional. SCAPI validates
-the payload. To discover tenant fields, fetch the live schema with
-`scapi_schemas_list`: `includeSchemas: true`, `apiFamily`, `apiName`, `apiVersion`.
+the payload. To discover tenant fields, search with `schemas: "live"` (narrow with
+`api`), or fetch the live schema with `scapi_schemas_list`: `includeSchemas: true`,
+`apiFamily`, `apiName`, `apiVersion`.
 Custom-property expansion defaults to true; disable with `expandCustomProperties: false`.
 `expandAll: true` retains full definitions; it is separate from custom-property
 expansion. Large contracts: fetch through `scapi_execute` and return only relevant
 fields ([example](references/custom-properties.md)). Requires `sfcc.scapi-schemas`.
 Use the same project/instance for schema lookup and writes.
 
-Live reads do not change offline `spec`. If schema access fails, report it; use
+Live contracts found by `schemas: "live"` search, expanded `scapi_schemas_list`
+fetches, or Schemas API reads inside `scapi_execute` are cached for that tenant.
+`scapi_execute` then routes to them, replacing bundled versions; they never change
+the offline `spec`. If schema access fails, report it; use
 already-known fields or ask for missing details. The optional CLI equivalent is
 `b2c scapi schemas get`, which also expands custom properties by default.
 
-For custom endpoint contracts, use `scapi_schemas_list` with `apiFamily: "custom"`;
-check registration with `scapi_custom_apis_get_status` when needed. Execute Admin
-custom endpoints by fetching their live contract through `scapi.request` first
-in each program, then making declared calls. The read enables that contract for
-this execution only. Use `AmOAuth2` operations with their declared `c_*` scopes;
-Shopper operations remain unsupported. [Custom API workflow](references/custom-apis.md).
+For custom endpoint contracts, search with `schemas: "live"` or use
+`scapi_schemas_list` with `apiFamily: "custom"`; check registration with
+`scapi_custom_apis_get_status` when needed. Custom endpoints found through live
+search are callable from `scapi_execute` for the same tenant. Otherwise fetch the
+live contract through `scapi.request` in the program before making declared calls. `AmOAuth2`
+and `ShopperToken` operations use their declared `c_*` scopes. [Custom API workflow](references/custom-apis.md).
 
 ## Authentication
 
@@ -80,14 +89,23 @@ Shopper operations remain unsupported. [Custom API workflow](references/custom-a
   or pass tokens first. For an explicitly requested token or external HTTP client,
   use `auth.accountManager()` / `auth.slas()` in `scapi_execute`:
   [token exports](references/tokens.md). These helpers are unavailable in search.
+- The operation's declared security selects the credential; there is no auth option.
 - Admin `AmOAuth2`: Account Manager credentials. Each request selects operation/tenant
   scopes and reuses suitable cached tokens; no upfront scope union.
+- Shopper `ShopperToken`: a SLAS guest shopper (`slasClientId`, plus `slasClientSecret`
+  for private clients; Storefront Next `.env` supplies both). Requests need `siteId`
+  (configured or `query.siteId`). The guest session is per site and persists across
+  executions for the server session, so baskets carry over. SLAS scopes are fixed on
+  the client, not requested per call; 401/403 diagnostics compare the token's scopes
+  with the operation's. `sfcc.shopper-standard` satisfies only operations that list it.
+  Public clients must allow redirect URI `http://localhost:3000/callback`.
 - Missing credentials: `config_inspect` with masking. `clientId` is Admin;
   `slasClientId` is Shopper. Configuration does not grant access.
 - Scope rejection: grant reported scopes in Account Manager; check extra configured
   scopes. Read/write alternatives are alternatives. Later failures do not undo writes.
-- Shopper requests through `scapi.request()` are unsupported; SLAS token export
-  is available for external clients.
+- Unsupported: registered-shopper-only operations (`RegisteredShopperToken`),
+  trusted-system/agent on-behalf tokens, and SLAS itself (`shopper/auth/v1`).
+  `auth.slas({flow: 'registered', ...})` exports a registered token for external clients.
   SLAS admin roles differ: [CLI/SDK](https://salesforcecommercecloud.github.io/b2c-developer-tooling/cli/slas).
 - HTTP 401/403 retain `status`/`data` plus `diagnostic`; preserve these.
   A 403 alone does not prove missing scopes.

package/content/guidance/mcp/scapi/references/custom-apis.md

@@ -27,17 +27,15 @@ async (input) => {
     query: input.query,
   });
   if (!result.ok) return {stage: 'endpoint', ...result};
-  return {status: result.status, fields: Object.fromEntries(
-    input.fields.map(name => [name, result.data[name]])
-  )};
-}
+  return {status: result.status, fields: Object.fromEntries(input.fields.map((name) => [name, result.data[name]]))};
+};
 ```
 
 - Schema lookup needs `sfcc.scapi-schemas`; execution needs the operation's declared
   `c_*` scope and tenant scope. Managed auth requests each; `sfcc.custom-apis` is
   for registration status, not custom business logic.
-- Only `AmOAuth2` execution is supported. A `ShopperToken` contract requires a
-  separate Shopper client; acquiring an Admin token does not enable it.
+- `AmOAuth2` contracts use Admin credentials; `ShopperToken` contracts use the SLAS
+  guest shopper (`slasClientId`, `siteId`). The declared security selects the credential.
 - Paths in custom schemas are endpoint-relative (`/info`); requests use
   `/custom/{apiName}/{apiVersion}/organizations/{organizationId}/info`.
 - Required parameters and JSON-body checks, SDK safety, cancellation, and execution

package/content/guidance/mcp/scapi/references/tokens.md

@@ -2,7 +2,7 @@
 
 Only use when the task explicitly needs a token or an HTTP client outside code
 mode. `scapi.request()` and snippets already authenticate; these helpers neither
-configure their authentication nor enable unsupported Shopper requests.
+configure their authentication nor enable unsupported registered-shopper requests.
 Run through `scapi_execute`, with the same project configuration and skill acknowledgment.
 
 ## Account Manager

package/dist/commands/mcp.d.ts

@@ -42,6 +42,7 @@ export default class McpServerCommand extends BaseCommand<typeof McpServerComman
         'auth-methods': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'user-auth': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'account-manager-host': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'client-auth-method': import("@oclif/core/interfaces").OptionFlag<"basic" | "basic-unencoded" | "body" | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'jwt-cert': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'jwt-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'jwt-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/mcp.js

@@ -199,7 +199,7 @@ export default class McpServerCommand extends BaseCommand {
         }),
         'docs-topics': Flags.string({
             description: 'Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). ' +
-                'Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, tooling, ' +
+                'Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, ocapi, tooling, ' +
                 'help-admin, help-merchant, help-kb. ' +
                 'Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.',
             env: 'SFCC_DOCS_TOPICS',

package/dist/tools/scapi/index.js

@@ -7,6 +7,7 @@ import { createMetricsGetTool } from './metrics-get.js';
 import { createScapiCustomApisStatusTool } from './scapi-custom-apis-get-status.js';
 import { createScapiSchemasListTool } from './scapi-schemas-list.js';
 import { createScapiCodeTools } from './scapi-code.js';
+import { ScapiLiveSchemaCache, ScapiShopperSessions } from '@salesforce/b2c-tooling-sdk/scapi';
 /**
  * Creates all tools for the SCAPI toolset.
  *
@@ -14,11 +15,14 @@ import { createScapiCodeTools } from './scapi-code.js';
  * @returns Array of MCP tools
  */
 export function createScapiTools(loadServices, executions) {
+    // Live contracts discovered by search or schema fetches are reused by execution for the same tenant.
+    const schemaCache = new ScapiLiveSchemaCache();
+    const shopperSessions = new ScapiShopperSessions();
     return [
-        ...createScapiCodeTools(loadServices, undefined, executions),
+        ...createScapiCodeTools(loadServices, undefined, executions, schemaCache, shopperSessions),
         createMetricsGetTool(loadServices),
         createScapiCustomApisStatusTool(loadServices),
-        createScapiSchemasListTool(loadServices),
+        createScapiSchemasListTool(loadServices, schemaCache),
     ];
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/scapi/scapi-code.d.ts

@@ -1,4 +1,5 @@
+import { ScapiLiveSchemaCache, ScapiShopperSessions } from '@salesforce/b2c-tooling-sdk/scapi';
 import type { McpTool } from '../../utils/types.js';
 import type { ServicesLoader } from '../adapter.js';
 import { ScapiExecutionRegistry } from './execution-registry.js';
-export declare function createScapiCodeTools(loadServices: ServicesLoader, snippetDirectory?: string, registry?: ScapiExecutionRegistry): McpTool[];
+export declare function createScapiCodeTools(loadServices: ServicesLoader, snippetDirectory?: string, registry?: ScapiExecutionRegistry, schemaCache?: ScapiLiveSchemaCache, shopperSessions?: ScapiShopperSessions): McpTool[];

package/dist/tools/scapi/scapi-code.js

@@ -4,7 +4,7 @@
  * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
  */
 import { z } from 'zod';
-import { loadScapiSchemas, runScapiCode, createScapiRequest, createScapiAuth, loadScapiSnippets, saveScapiSnippet, } from '@salesforce/b2c-tooling-sdk/scapi';
+import { loadScapiSchemas, mergeScapiSchemas, scapiTenantKey, ScapiLiveSchemaCache, ScapiShopperSessions, runScapiCode, createScapiRequest, createScapiAuth, loadScapiSnippets, saveScapiSnippet, } from '@salesforce/b2c-tooling-sdk/scapi';
 import { toOrganizationId } from '@salesforce/b2c-tooling-sdk/clients';
 import { getB2CConfigDirectory } from '@salesforce/b2c-tooling-sdk/config';
 import { resolveEffectiveSafetyConfig, loadGlobalSafetyConfig } from '@salesforce/b2c-tooling-sdk/safety';
@@ -23,19 +23,19 @@ function requireScapiSkill(read) {
     if (read !== true)
         throw new Error('SCAPI_SKILL_REQUIRED: Read skill://mcp/scapi/SKILL.md through resources or skills_read, then retry with skillRead: true.');
 }
-const searchDescription = `Discover bundled Admin/Shopper SCAPI contracts offline. Prefer dedicated tools when available.
-Read skill://mcp/scapi/SKILL.md first.
+const searchDescription = `Discover Admin/Shopper SCAPI contracts; prefer dedicated tools. Read skill://mcp/scapi/SKILL.md first.
+Default: bundled, offline. schemas:"live": tenant c_*, custom, newer APIs, reused by execute.
 
-Schemas can be huge. Discover operation IDs/paths first; then select required and task-relevant fields. Avoid whole operations or request/response trees. Local refs are expanded; recursive/deep refs remain $ref.
+Schemas can be huge. Find operation IDs/paths first; then select required and task fields, not whole trees. Local refs expand; recursive/deep refs remain $ref.
 
-Code objects (execute JavaScript, not these types):
+Code objects (write JavaScript, not these types):
 interface Operation {
   api: string; operationId: string; summary?: string;
   parameters: Array<{name: string; in: string; required?: boolean; schema?: unknown}>;
   requestBody?: {required?: boolean; content: Record<string, {schema: any}>};
   responses?: Record<string, unknown>;
   security: Array<Record<string, string[]>>;
-  auth: {types: string[]; schemes: string[]; executable: boolean}; // runtime support, not configured access
+  auth: {types: string[]; schemes: string[]; executable: boolean}; // runtime support, not access
 }
 declare const spec: {
   apis: Array<{id: string; apiFamily: string; apiName: string; apiVersion: string; authTypes: string[]}>;
@@ -57,7 +57,7 @@ async () => {
   return {parameters: op.parameters, required: body.required,
     fields: Object.fromEntries(fields.map(k => [k, body.properties[k]])), auth: op.auth, security: op.security};
 }`;
-const executeDescription = `Read, create, update, or delete Commerce records through SCAPI Admin APIs when no dedicated tool fits. Discover standard endpoints with scapi_search; for custom APIs, fetch the live contract through scapi.request() in the same program first. Requests authenticate automatically. JSON requests; no Shopper execution or binary transfers.
+const executeDescription = `Read, create, update, or delete Commerce records through SCAPI Admin or Shopper APIs when no dedicated tool fits. Discover endpoints with scapi_search; operations found with schemas:"live" (including custom APIs) are callable here for the same tenant. Otherwise fetch a custom API's live contract through scapi.request() in the same program first. Auth is automatic; Shopper APIs run as a guest whose session (basket) persists per site. JSON only; no binary transfers.
 Read skill://mcp/scapi/SKILL.md first.
 
 Reuse workflows with await codemode.run(name, input); describe first. async (input) receives input. Completed executionId enables scapi_snippet_save.
@@ -86,20 +86,26 @@ function failure(error, resolution) {
     return {
         ...codeResult({
             error: message,
-            ...(/^SCAPI_(ADMIN_|SHOPPER_|AUTH_|SCOPE_)/.test(message)
+            ...(/^SCAPI_(ADMIN_|SHOPPER_|REGISTERED_SHOPPER_|AUTH_|SCOPE_)/.test(message)
                 ? { skillReferences: [MCP_SKILL_REFERENCES.scapiAuthentication] }
                 : {}),
         }, resolution),
         isError: true,
     };
 }
-export function createScapiCodeTools(loadServices, snippetDirectory, registry = new ScapiExecutionRegistry()) {
+export function createScapiCodeTools(loadServices, snippetDirectory, registry = new ScapiExecutionRegistry(), schemaCache = new ScapiLiveSchemaCache(), shopperSessions = new ScapiShopperSessions()) {
     // Retain only source for the last 50 completed executions, until this server ends.
     const executions = new Map();
     const searchInput = {
+        ...createProjectContextInputSchema('configuration'),
         code,
         skillRead,
-        api: z.string().optional().describe('Limit schemas to family/name/version. Omit for all standard APIs.'),
+        api: z.string().optional().describe('Limit schemas to family/name/version. Omit for all APIs.'),
+        schemas: z
+            .enum(['bundled', 'live'])
+            .optional()
+            .describe('bundled (default, offline) or live tenant contracts from the Schemas API.'),
+        refresh: z.boolean().optional().describe('With schemas:"live", refetch instead of using cached contracts.'),
         authType: z
             .enum(['admin', 'shopper'])
             .optional()
@@ -136,27 +142,48 @@ export function createScapiCodeTools(loadServices, snippetDirectory, registry =
             toolsets: ['SCAPI', 'PWAV3', 'STOREFRONTNEXT'],
             effect: 'read',
             idempotent: true,
-            openWorld: false,
+            openWorld: true,
             async handler(args, context) {
+                let resolution;
                 try {
                     const input = z.object(searchInput).strict().parse(args);
                     requireScapiSkill(input.skillRead);
-                    const documents = loadScapiSchemas().filter((document) => !input.api || document.entry.id === input.api);
-                    if (documents.length === 0)
-                        throw new Error('Unknown schema ID. Omit api to discover available APIs.');
-                    return codeResult({
-                        result: await runScapiCode({
-                            code: input.code,
-                            documents,
-                            authType: input.authType,
+                    if (input.schemas !== 'live' && input.refresh !== undefined)
+                        throw new Error('SCAPI_SEARCH_ARGUMENT_INVALID: refresh requires schemas:"live".');
+                    let documents;
+                    let failures = [];
+                    if (input.schemas === 'live') {
+                        const services = await loadServices(input);
+                        resolution = services.getResolution();
+                        // Throws with configuration guidance when shortCode, tenantId, or OAuth credentials are missing.
+                        const client = services.getScapiSchemasClient();
+                        const organizationId = services.getOrganizationId();
+                        const tenant = scapiTenantKey(services.getShortCode(), organizationId);
+                        ({ documents, failures } = await schemaCache.load(tenant, client, organizationId, {
+                            api: input.api,
+                            refresh: input.refresh,
                             signal: context?.signal,
-                            timeoutMs: 10_000,
-                            snippets: loadScapiSnippets(snippetDirectory),
-                        }),
+                        }));
+                        if (documents.length === 0 && failures.length === 0)
+                            throw new Error('Unknown schema ID for this tenant. Omit api to discover available APIs.');
+                    }
+                    else {
+                        documents = loadScapiSchemas().filter((document) => !input.api || document.entry.id === input.api);
+                        if (documents.length === 0)
+                            throw new Error('Unknown schema ID. Omit api to discover available APIs, or use schemas:"live" for tenant and custom APIs.');
+                    }
+                    const result = await runScapiCode({
+                        code: input.code,
+                        documents,
+                        authType: input.authType,
+                        signal: context?.signal,
+                        timeoutMs: 10_000,
+                        snippets: loadScapiSnippets(snippetDirectory),
                     });
+                    return codeResult({ result, ...(failures.length > 0 ? { schemaFailures: failures } : {}) }, resolution);
                 }
                 catch (error) {
-                    return failure(error);
+                    return failure(error, resolution);
                 }
             },
         },
@@ -192,6 +219,7 @@ export function createScapiCodeTools(loadServices, snippetDirectory, registry =
                     resolution = services.getResolution();
                     const config = services.getResolvedConfig();
                     const { shortCode, tenantId, siteId } = config.values;
+                    const tenant = shortCode && tenantId ? scapiTenantKey(shortCode, toOrganizationId(tenantId)) : undefined;
                     const safetyEnvironment = Object.fromEntries(['SFCC_SAFETY_LEVEL', 'SFCC_SAFETY_CONFIRM', 'SFCC_SAFETY_CONFIG'].map((name) => [
                         name,
                         services.getEnvironmentVariable(name),
@@ -206,7 +234,20 @@ export function createScapiCodeTools(loadServices, snippetDirectory, registry =
                                 tenantId,
                                 siteId,
                                 auth: () => config.createOAuth(),
-                                documents: loadScapiSchemas(),
+                                // Guest sessions outlive executions so shopper state (baskets) carries across them.
+                                shopperAuth: shopperSessions.for({
+                                    shortCode,
+                                    tenantId,
+                                    slasClientId: config.values.slasClientId,
+                                    slasClientSecret: config.values.slasClientSecret,
+                                }),
+                                // Live contracts discovered for this tenant replace bundled ones; the user owns their accuracy.
+                                documents: mergeScapiSchemas(loadScapiSchemas(), tenant ? schemaCache.get(tenant) : []),
+                                onSchema(document, customProperties) {
+                                    // Keep expanded tenant contracts from being replaced by unexpanded fetches.
+                                    if (tenant && (customProperties || document.entry.apiFamily === 'custom'))
+                                        schemaCache.put(tenant, document);
+                                },
                                 confirm: (request) => execution.confirm(request),
                                 onDispatch: () => execution.markDispatched(),
                                 safety: resolveEffectiveSafetyConfig(config.values.safety, loadGlobalSafetyConfig(getB2CConfigDirectory(), safetyEnvironment, resolution?.projectDirectory?.path), safetyEnvironment),

package/dist/tools/scapi/scapi-schemas-list.d.ts

@@ -1,5 +1,6 @@
 import type { Services } from '../../services.js';
 import type { McpTool } from '../../utils/index.js';
+import { type ScapiLiveSchemaCache } from '@salesforce/b2c-tooling-sdk/scapi';
 /**
  * Creates the scapi_schemas_list tool.
  *
@@ -7,6 +8,7 @@ import type { McpTool } from '../../utils/index.js';
  * Lists or fetches SCAPI schema specifications; includes standard SCAPI and custom API as schema types.
  *
  * @param loadServices - Function that loads configuration and returns Services instance
+ * @param schemaCache - Optional live contract cache shared with SCAPI code mode
  * @returns MCP tool for listing/fetching SCAPI schemas
  */
-export declare function createScapiSchemasListTool(loadServices: () => Promise<Services> | Services): McpTool;
+export declare function createScapiSchemasListTool(loadServices: () => Promise<Services> | Services, schemaCache?: ScapiLiveSchemaCache): McpTool;

package/dist/tools/scapi/scapi-schemas-list.js

@@ -16,6 +16,7 @@ import { z } from 'zod';
 import { createToolAdapter, jsonResult } from '../adapter.js';
 import { getApiErrorMessage } from '@salesforce/b2c-tooling-sdk/clients';
 import { collapseOpenApiSchema } from '@salesforce/b2c-tooling-sdk/schemas';
+import { createLiveScapiDocument, scapiTenantKey } from '@salesforce/b2c-tooling-sdk/scapi';
 /**
  * Builds the base URL for a SCAPI API endpoint.
  *
@@ -52,10 +53,11 @@ function getSchemasApiError(error, response) {
  * @param params.organizationId - Organization ID
  * @param params.args - Input arguments with API identifiers
  * @param params.shortCode - Optional short code for building base URL
+ * @param params.schemaCache - Optional live contract cache shared with SCAPI code mode
  * @returns Schema fetch output
  */
 async function fetchSpecificSchema(params) {
-    const { client, organizationId, args, shortCode } = params;
+    const { client, organizationId, args, shortCode, schemaCache } = params;
     const { apiFamily, apiName, apiVersion, expandAll, status } = args;
     // Warn if status filter was provided (it's ignored in fetch mode)
     const warning = status
@@ -70,6 +72,15 @@ async function fetchSpecificSchema(params) {
     if (error) {
         throw new Error(`Failed to fetch schema for ${apiFamily}/${apiName}/${apiVersion}: ${getSchemasApiError(error, response)}`);
     }
+    // Expanded tenant contracts become searchable and executable in SCAPI code mode.
+    if (schemaCache && shortCode && (args.expandCustomProperties !== false || apiFamily === 'custom')) {
+        try {
+            schemaCache.put(scapiTenantKey(shortCode, organizationId), createLiveScapiDocument({ apiFamily: apiFamily, apiName: apiName, apiVersion: apiVersion }, data));
+        }
+        catch {
+            // Not a usable OpenAPI contract; still return it to the caller.
+        }
+    }
     // Apply collapsing unless expandAll is requested
     const collapsed = !expandAll;
     const processedSchema = collapsed
@@ -190,9 +201,10 @@ function getAvailableFilters(schemas) {
  * Lists or fetches SCAPI schema specifications; includes standard SCAPI and custom API as schema types.
  *
  * @param loadServices - Function that loads configuration and returns Services instance
+ * @param schemaCache - Optional live contract cache shared with SCAPI code mode
  * @returns MCP tool for listing/fetching SCAPI schemas
  */
-export function createScapiSchemasListTool(loadServices) {
+export function createScapiSchemasListTool(loadServices, schemaCache) {
     return createToolAdapter({
         name: 'scapi_schemas_list',
         effect: 'read',
@@ -245,7 +257,7 @@ export function createScapiSchemasListTool(loadServices) {
             }
             // Execute appropriate mode
             if (isFetchMode) {
-                return fetchSpecificSchema({ client, organizationId, args, shortCode });
+                return fetchSpecificSchema({ client, organizationId, args, shortCode, schemaCache });
             }
             return fetchSchemasList({ client, organizationId, args, shortCode });
         },

package/node_modules/@salesforce/b2c-agent-plugins/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @salesforce/b2c-agent-plugins
 
+## 1.10.3
+
+### Patch Changes
+
+- [#720](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/720) [`c1b0c17`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c1b0c17e286a69a4945c9d66c0209c87b5441709) - Docs search now includes the OCAPI reference from B2C Commerce Developer Center (usage, hooks, settings, and best practices), available under the new `ocapi` category (45 articles). (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#723](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/723) [`3172e1b`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/3172e1bff2e6bbb3246a87092c489a8f866b696e) - `scapi_search` can now search your instance's live SCAPI schemas with `schemas: "live"`, including your custom attributes, custom APIs, and APIs newer than the bundled reference. `scapi_execute` can then call what it found on the same instance. Offline search is still the default. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#723](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/723) [`3172e1b`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/3172e1bff2e6bbb3246a87092c489a8f866b696e) - `scapi_execute` can now call Shopper APIs as a guest shopper using your SLAS client, so any Storefront Next project works out of the box. The guest session persists across executions, so baskets carry over. Registered-shopper-only operations are not yet supported. (Thanks [@clavery](https://github.com/clavery)!)
+
 ## 1.10.2
 
 ### Patch Changes

package/node_modules/@salesforce/b2c-agent-plugins/b2c/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C Commerce development skills including Custom API development guides.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C Commerce development skills including Custom API development guides.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c-cli",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C CLI Skills for Salesforce Commerce Cloud development.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c-cli",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C CLI Skills for Salesforce Commerce Cloud development.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-config/SKILL.md

@@ -206,6 +206,29 @@ b2c setup ide tsserver-plugin --json
 
 The B2C DX VS Code extension needs no setup — it injects the same TypeScript Server plugin at runtime.
 
+## OpenShell Sandbox (Beta)
+
+`b2c setup openshell` creates an NVIDIA OpenShell sandbox from the resolved configuration. Secrets stay on the OpenShell gateway, and the sandbox can reach only the B2C hosts in use, at the configured Safety Mode level (or `NONE` if unset); Safety Mode rules carry over. Requires the `openshell` CLI with a running gateway, and Docker.
+
+```bash
+# Sandbox for the active instance at the configured Safety Mode level
+b2c setup openshell
+
+# Read-only sandbox
+b2c setup openshell --safety-level READ_ONLY
+
+# Allow writes but not deletes; include the MCP server
+b2c setup openshell --safety-level NO_DELETE --mcp
+
+# Write the policy, profiles, Dockerfile, and setup.sh without running anything
+b2c setup openshell --dry-run
+
+# Run a command in the sandbox
+openshell sandbox exec -n b2c-<instance> -- b2c code list
+```
+
+Edit `.openshell/<sandbox>/policy.yaml` and re-run to apply it; use `--recreate` after changing secrets or configuration. Add hosts with `--allow-host`. Only client credentials work in the sandbox (no browser login). See the [Agent Sandboxing guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/agent-sandboxing#openshell).
+
 ## Managing Instances
 
 ### List Configured Instances

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-docs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: b2c-docs
-description: Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say "how do I implement passwordless login" or "what methods does Basket have" or "how do I deploy a PWA Kit bundle" or "how do I import a site archive" or "what SCAPI endpoints are available for checkout".
+description: Search and read B2C Commerce documentation using the b2c CLI. Covers Script API reference (dw.* classes/modules), Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce, OCAPI), Salesforce Help (Business Manager administration and merchandising), tooling documentation (CLI/MCP/SDK), standard job steps, and XSD schemas. Use this skill for ANY B2C Commerce developer or administrator question that is not already grounded in a loaded skill or the current project context — even if they just say "how do I implement passwordless login" or "what methods does Basket have" or "how do I deploy a PWA Kit bundle" or "how do I import a site archive" or "what SCAPI endpoints are available for checkout".
 ---
 
 # B2C Docs Skill
@@ -15,7 +15,7 @@ Use the `b2c` CLI to search and read B2C Commerce documentation spanning multipl
 
 ## Key Features
 
-- **Multi-corpus search** — Search across Script API, Developer Center guides, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
+- **Multi-corpus search** — Search across Script API, Developer Center guides, OCAPI reference, Salesforce Help (admin + merchandising), internal tooling docs (guides, CLI reference, MCP, and VS Code extension), job steps, and schemas in a unified index
 - **Workspace-aware search** — Auto-detects project type (cartridges, SFRA, PWA Kit, Storefront Next) and boosts relevant documentation while de-boosting competing storefront frameworks
 - **Category filtering** — Use `--category` to narrow results to a specific corpus (e.g., `commerce-api`, `pwa-kit-managed-runtime`, `sfra`, `script-api`, `help-admin`, `help-merchant`, `help-kb`)
 - **Triage metadata** — Search results include `category`, `summary`, `keywords`, and `url` to help identify the right match without reading full content
@@ -114,7 +114,7 @@ The docs search understands which workspace framework your project uses and auto
 
 **Category boost mapping:**
 
-- Always relevant (any workspace): `b2c-commerce`, `tooling`
+- Always relevant (any workspace): `b2c-commerce`, `ocapi`, `tooling`
 - `cartridges` → `script-api`, `job-step`
 - `sfra` → `sfra`
 - `pwa-kit-v3` → `pwa-kit-managed-runtime`, `commerce-api`
@@ -239,6 +239,7 @@ xmllint --schema "$(b2c docs schema catalog --path)" my-catalog.xml --noout
 | `sfra`                    | Storefront Reference Architecture (SFRA) guides                                                                                  | `sfra/controllers-and-routes`                       |
 | `sfnext`                  | Storefront Next guides                                                                                                           | `sfnext/sfnext-get-started`                         |
 | `b2c-commerce`            | General B2C Commerce platform guides                                                                                             | `b2c-commerce/business-manager-overview`            |
+| `ocapi`                   | OCAPI reference — usage, hooks, settings, and best practices for the Open Commerce API                                           | `ocapi/ocapisettings`, `ocapi/bestpractices`        |
 | `tooling`                 | B2C CLI reference, guides, MCP docs, SDK guidance, and VS Code extension docs                                                    | `guide-authentication`, `cli-jobs`                  |
 | `job-step`                | Standard (system) job step catalog                                                                                               | `ImportCatalog`, `ExportCatalog`, `job-steps`       |
 | `help-admin`              | Salesforce Help — administration/ops (import/export, jobs, replication, security, Account Manager, permissions, logs, inventory) | `help-admin/b2c_site_import_export`                 |

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-scapi-schemas/SKILL.md

@@ -9,10 +9,12 @@ Browse standard or tenant-specific SCAPI OpenAPI contracts.
 
 ## Tool choice
 
-When B2C MCP is available, prefer offline `scapi_search` for standard Admin and
-Shopper contracts. Read `skill://mcp/scapi/SKILL.md` via resource or `skills_read`
-first; pass `skillRead: true`. Discover method/path/operationId, then selected
-inputs and fields. No credentials or live Schemas API access needed.
+When B2C MCP is available, prefer `scapi_search` for Admin and Shopper contracts.
+Read `skill://mcp/scapi/SKILL.md` via resource or `skills_read` first; pass
+`skillRead: true`. Discover method/path/operationId, then selected inputs and
+fields. The default searches bundled standard contracts offline; `schemas: "live"`
+searches the tenant's contracts (custom attributes, custom APIs, newer APIs) and
+makes them callable from `scapi_execute`.
 
 Use `scapi_schemas_list` for live schemas, custom attributes, and custom APIs.
 For tenant fields, supply API family/name/version and `includeSchemas: true`.
@@ -20,9 +22,9 @@ Custom-property expansion defaults to true; `expandAll: true` preserves full def
 For large schemas, fetch/filter through code mode as described in the MCP SCAPI skill.
 Use `scapi_custom_apis_get_status` for registration status. Live schema access needs
 `sfcc.scapi-schemas`. Prefer a dedicated task tool for execution, otherwise
-`scapi_execute` supports Admin JSON calls with configured auth/scopes. For custom
+`scapi_execute` supports Admin and guest Shopper JSON calls with configured auth/scopes. For custom
 Admin endpoints, fetch the live contract through `scapi.request` in each program
-before calling it; follow the MCP SCAPI skill. Shopper and binary execution are
+before calling it; follow the MCP SCAPI skill. Registered-shopper and binary execution are
 unsupported. Use docs tools for semantics
 and limits rather than duplicating contract discovery.
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "b2c-ops",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c-ops",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/b2c-agent-plugins",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "B2C Commerce agent skills plugins for development and operations. Private — distributed via GitHub release zips.",
   "private": true
 }

package/node_modules/@salesforce/b2c-agent-plugins/storefront-next/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "storefront-next",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "Storefront Next development skills for building React 19 storefronts on Salesforce B2C Commerce.",
   "author": {
     "name": "Salesforce"

package/node_modules/@salesforce/b2c-agent-plugins/storefront-next/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "storefront-next",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "Storefront Next development skills for building React 19 storefronts on Salesforce B2C Commerce.",
   "author": {
     "name": "Salesforce"

package/oclif.manifest.json

@@ -230,6 +230,20 @@
           "multiple": false,
           "type": "option"
         },
+        "client-auth-method": {
+          "description": "How the client ID and secret are sent to Account Manager (default: basic)",
+          "env": "SFCC_CLIENT_AUTH_METHOD",
+          "helpGroup": "AUTH",
+          "name": "client-auth-method",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "basic",
+            "basic-unencoded",
+            "body"
+          ],
+          "type": "option"
+        },
         "jwt-cert": {
           "description": "Path to JWT certificate file (cert.pem) for JWT Bearer authentication",
           "env": "SFCC_JWT_CERT",
@@ -444,7 +458,7 @@
           "type": "option"
         },
         "docs-topics": {
-          "description": "Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, tooling, help-admin, help-merchant, help-kb. Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.",
+          "description": "Limit the documentation exposed by the docs tools to these categories (comma-separated allowlist). Options: script-api, job-step, commerce-api, pwa-kit-managed-runtime, sfnext, sfra, b2c-commerce, ocapi, tooling, help-admin, help-merchant, help-kb. Bounds the whole docs corpus; per-call category/storefront narrow within it. Unknown names are ignored.",
           "env": "SFCC_DOCS_TOPICS",
           "name": "docs-topics",
           "hasDynamicHelp": false,
@@ -462,5 +476,5 @@
       "enableJsonFlag": false
     }
   },
-  "version": "3.1.2"
+  "version": "3.2.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/b2c-dx-mcp",
   "description": "MCP server for B2C Commerce developer experience tools",
-  "version": "3.1.2",
+  "version": "3.2.0",
   "author": "Salesforce",
   "license": "Apache-2.0",
   "repository": "SalesforceCommerceCloud/b2c-developer-tooling",
@@ -80,8 +80,8 @@
     "ts-morph": "27.0.2",
     "yaml": "2.9.0",
     "zod": "4.5.4",
-    "@salesforce/b2c-agent-plugins": "1.10.2",
-    "@salesforce/b2c-tooling-sdk": "2.2.0"
+    "@salesforce/b2c-agent-plugins": "1.10.3",
+    "@salesforce/b2c-tooling-sdk": "2.3.0"
   },
   "bundledDependencies": [
     "@modelcontextprotocol/server",