@salesforce/b2c-dx-mcp 3.2.1 → 3.4.0

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-job/SKILL.md

@@ -16,9 +16,9 @@ Use `--project-directory` when running outside the target project. Inspect with
 `b2c setup inspect --json` or MCP `config_inspect`; both mask secrets by default.
 Override configured values only when needed. For resolution issues, use `b2c-cli:b2c-config`.
 
-No dedicated MCP job tool exists. Prefer these CLI workflows for running/waiting
-on jobs and transferring archives. MCP `scapi_search`/`scapi_execute` can compose
-supported Admin requests; they do not replace the CLI's archive transfer workflow.
+No dedicated MCP job tool exists. In an MCP session, start, wait for, and review
+jobs in code mode (`skill://mcp/b2c-mcp-scapi/references/jobs.md`); use the CLI
+for archive transfer (import/export) and when running from a terminal.
 
 ## Run and inspect
 
@@ -30,6 +30,12 @@ b2c job wait my-job execution-id --timeout 600
 b2c job log my-job --failed
 ```
 
+Rebuild a search index (system jobs take `--body`, never `-P`):
+
+```bash
+b2c job run sfcc-search-index-product-full-update --wait --body '{"site_scope":["MySite"]}'
+```
+
 `job run` returns immediately unless `--wait` is supplied. For raw system-job
 bodies, search indexing, standard step choices, execution deletion, and backend
 configuration: [run and monitor](references/RUN-AND-MONITOR.md).

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-job/references/IMPORT.md

@@ -2,7 +2,7 @@
 
 ### Import Site Archives
 
-The `job import` command waits for the import job to complete by default. The same command imports a **job definition** (`jobs.xml` at the archive root) that registers a new runnable job on the instance — for the `jobs.xml` structure (job/flow/step, step `type`, the required `<triggers>` element), see the [jobs.xml Reference](../../../../b2c/skills/b2c-custom-job-steps/references/JOBS-XML.md).
+The `job import` command waits for the import job to complete by default. The same command imports a **job definition** (`jobs.xml` at the archive root) that registers a new runnable job on the instance — for the `jobs.xml` structure (job/flow/step, step `type`, the required `<triggers>` element), see the jobs.xml reference in the `b2c-custom-job-steps` skill.
 
 ```bash
 # import a local directory as a site archive (waits for completion by default)

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-job/references/RUN-AND-MONITOR.md

@@ -21,17 +21,46 @@ b2c job run my-custom-job --wait --show-log
 
 ### Run System Jobs with Custom Request Bodies
 
-Some system jobs (like search indexing) use non-standard request schemas. Use `--body` to provide a raw JSON request body:
+System jobs (`sfcc-*`) do **not** take the generic `parameters` array, so `-P` fails
+for them (`unknown property 'parameters'`). Send the job's own document with `--body`
+(`--body` and `-P` are mutually exclusive). The body is the same JSON on SCAPI and
+OCAPI; field names are snake_case and `site_scope` is a plain array of site IDs.
 
 ```bash
-# run search index job for specific sites
-b2c job run sfcc-search-index-product-full-update --wait --body '{"site_scope":{"named_sites":["RefArch","SiteGenesis"]}}'
+# rebuild the product search index for one site
+b2c job run sfcc-search-index-product-full-update --wait --body '{"site_scope":["RefArch"]}'
 
-# run search index job for a single site
-b2c job run sfcc-search-index-product-full-update --wait --body '{"site_scope":{"named_sites":["RefArch"]}}'
+# several sites
+b2c job run sfcc-search-index-product-full-update --wait --body '{"site_scope":["RefArch","SiteGenesis"]}'
 ```
 
-Note: `--body` and `-P` are mutually exclusive.
+| System job ID                                      | Body                                    |
+| -------------------------------------------------- | --------------------------------------- |
+| `sfcc-search-index-product-full-update`            | `{"site_scope":["SiteId"]}`             |
+| `sfcc-search-index-product-incremental-update`     | `{"site_scope":["SiteId"]}`             |
+| `sfcc-search-index-content-full-update`            | `{"site_scope":["SiteId"]}`             |
+| `sfcc-search-index-content-incremental-update`     | `{"site_scope":["SiteId"]}`             |
+| `sfcc-search-index-active-data-full-update`        | `{"site_scope":["SiteId"]}`             |
+| `sfcc-search-index-active-data-incremental-update` | `{"site_scope":["SiteId"]}`             |
+| `sfcc-site-archive-import` / `-export`             | use `b2c job import` / `b2c job export` |
+
+Common mistakes (all wrong): `{"site_scope":{"named_sites":[...]}}` (object, rejected as
+"expected START*ARRAY"), `siteScope`/camelCase, and `-P SiteScope=...`. The
+`SiteScope={"named_sites":[...]}` value is a \_parameter* of custom/standard-step jobs
+run with `-P`, not a system-job body. Source: OCAPI `SearchIndexUpdateConfiguration`
+(`b2c docs read ocapi/searchindexupdateconfiguration`).
+
+A `JobAlreadyRunningException` (400) means another index job of that kind is active for
+a different site scope; wait for it rather than retrying.
+
+A SCAPI 400 (for example a decode error naming the bad property) is a request error and is
+reported as-is; `auto` does not retry it over OCAPI. Fallback happens only for
+auth/capability rejections (invalid scope, 401/403/404/405/406/415); if OCAPI then also
+fails, the error shows both, with "The SCAPI attempt was rejected first: ...". An OCAPI
+"isn't allowed for the current client" means the client has no OCAPI job permission.
+
+From MCP code mode, the same job is a SCAPI `createJobExecution` call; see
+`skill://mcp/b2c-mcp-scapi/references/jobs.md` (section "Start a job").
 
 ### Standard (System) Job Steps
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-metrics/SKILL.md

@@ -312,4 +312,4 @@ All operations accept `(client, tenantId, options?)` and return `Promise<Metrics
 - **404/category not enabled**: the category may not be enabled for your organization (closed beta)
 - **503/temporarily unavailable**: metrics service may be temporarily unavailable
 
-For full command reference, use `b2c metrics --help` and see [CLI docs](/cli/metrics) and [Metrics Guide](/guide/metrics).
+For full command reference, use `b2c metrics --help` and see [CLI docs](https://salesforcecommercecloud.github.io/b2c-developer-tooling/cli/metrics.md) (`b2c docs read cli-metrics`) and [Metrics Guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/metrics.md) (`b2c docs read guide-metrics`).

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-mrt/SKILL.md

@@ -19,8 +19,8 @@ Run `b2c setup inspect` to see the resolved configuration and which source provi
 
 Most MRT commands run against the legacy MRT Cloud API (API key). Several commands can also run over the SCAPI MRT backend: `mrt bundle history`, `mrt bundle list`, `mrt bundle deploy` (both the local-build push and deploying an existing `<bundleId>`), and the `mrt env var` family (`list` / `set` / `push` / `delete`). Choose with `--mrt-backend` (`MRT_BACKEND` / `SFCC_MRT_BACKEND`, or `mrtBackend` in `dw.json`):
 
-- `auto` (default) — use SCAPI when it's configured (`--short-code` + `--tenant-id` + client-credentials or JWT Bearer auth), otherwise legacy. Falls back to legacy on safe pre-execution errors. Each command requests its own scopes: bundle commands use `sfcc.storefront.deployments[.rw]`; env var commands use `sfcc.storefront.environments[.rw]` (reads accept either tier, writes require `.rw`).
-- `legacy` — always the MRT Cloud API.
+- `legacy` (default) — always the MRT Cloud API.
+- `auto` — use SCAPI when it's configured (`--short-code` + `--tenant-id` + client-credentials or JWT Bearer auth), otherwise legacy. Falls back to legacy on safe pre-execution errors. Each command requests its own scopes: bundle commands use `sfcc.storefront.deployments[.rw]`; env var commands use `sfcc.storefront.environments[.rw]` (reads accept either tier, writes require `.rw`).
 - `scapi` — always SCAPI, with no fallback; errors if prerequisites are missing. Also errors on unsupported commands (every MRT command except the bundle and env var commands above).
 
 Notes:
@@ -183,7 +183,7 @@ Configure MRT settings in your project's `dw.json`:
 export MRT_API_KEY=your-api-key
 export MRT_PROJECT=my-storefront
 export MRT_ENVIRONMENT=staging
-export MRT_BACKEND=auto        # auto (default) | legacy | scapi
+export MRT_BACKEND=legacy      # legacy (default) | auto | scapi
 ```
 
 ### ~/.mobify Config

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-scapi-custom/SKILL.md

@@ -9,7 +9,7 @@ Use the `b2c` CLI plugin to manage SCAPI Custom API endpoints and check their re
 
 When B2C MCP is available, prefer `scapi_custom_apis_get_status` for registration
 and `scapi_schemas_list` for live contracts. For Admin custom API execution, read
-`skill://mcp/scapi/SKILL.md`; fetch the contract through `scapi.request` in the
+`skill://mcp/b2c-mcp-scapi/SKILL.md`; fetch the contract through `scapi.request` in the
 program before calling its endpoints. Schema reads need `sfcc.scapi-schemas`;
 execution needs the declared `c_*` scope. Shopper execution is unsupported.
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-scapi-schemas/SKILL.md

@@ -10,7 +10,7 @@ Browse standard or tenant-specific SCAPI OpenAPI contracts.
 ## Tool choice
 
 When B2C MCP is available, prefer `scapi_search` for Admin and Shopper contracts.
-Read `skill://mcp/scapi/SKILL.md` via resource or `skills_read` first; pass
+Read `skill://mcp/b2c-mcp-scapi/SKILL.md` via resource or `skills_read` first; pass
 `skillRead: true`. Discover method/path/operationId, then selected inputs and
 fields. The default searches bundled standard contracts offline; `schemas: "live"`
 searches the tenant's contracts (custom attributes, custom APIs, newer APIs) and
@@ -29,7 +29,11 @@ unsupported. Use docs tools for semantics
 and limits rather than duplicating contract discovery.
 
 For CLI work, use `b2c scapi schemas list` and
-`b2c scapi schemas get <family> <name> <version>`; both use live access.
+`b2c scapi schemas get <family> <name> <version>`; both use live access and fall back to the
+bundled standard contracts (with a warning and `source: "bundled"` in `--json`) when it fails.
+The Schemas API returns operation summaries/descriptions and examples only when asked:
+`--expand-paths`/`--expand-schemas` fetch the prose, `--expand-all` fetches everything, and
+`--include summaries,descriptions,...` chooses sections directly.
 CLI get expands custom properties by default; `--no-expand-custom-properties`
 requests the standard contract. MCP also defaults to expansion; disable it with
 `expandCustomProperties: false`. Known custom fields can be sent through standard

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-site-import-export/SKILL.md

@@ -48,7 +48,7 @@ review and trim before committing, preserving XSD-required fields.
 - Archive layout and XML workflows: [archive workflows](references/WORKFLOWS.md).
 - Attribute/type XML patterns: [metadata XML](references/METADATA-XML.md).
 - Remote imports, size splitting, and import-set options: [import options](references/IMPORT-OPTIONS.md).
-- Export flags, data units, and compact JSON results: [export reference](../b2c-job/references/EXPORT.md).
+- Export flags, data units, and compact JSON results: the export reference in the `b2c-job` skill.
 - Ordered migrations, naming, history, and recovery: `b2c-cli:b2c-import-set-migrations`.
 - Service configuration XML: `b2c:b2c-webservices`.
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-sites/SKILL.md

@@ -95,7 +95,7 @@ Site reads and cartridge-path writes run over SCAPI (the `site/sites` API) when
 ```bash
 b2c sites list
 # then use the ID in other commands
-b2c site-import upload --site RefArch ...
+b2c job export --site RefArch --site-data content,site_preferences
 ```
 
 **Checking site status:** The status column shows the storefront status (online/offline) for each site, useful for verifying deployment state.

package/node_modules/@salesforce/b2c-agent-plugins/b2c-cli/skills/b2c-slas/SKILL.md

@@ -7,7 +7,7 @@ description: Create, update, and manage SLAS (Shopper Login and API Access Servi
 
 Use the `b2c` CLI plugin to manage SLAS (Shopper Login and API Access Service) API clients and credentials.
 
-> **Important:** SLAS is for **shopper** (customer) authentication used by storefronts and headless commerce. For **admin** tokens (OCAPI, Admin APIs), use `b2c auth token` - see [b2c-config skill](../b2c-config/SKILL.md).
+> **Important:** SLAS is for **shopper** (customer) authentication used by storefronts and headless commerce. For **admin** tokens (OCAPI, Admin APIs), use `b2c auth token` - see the `b2c-config` skill.
 
 > **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli slas client list`).
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "b2c-ops",
-  "version": "1.10.3",
-  "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
+  "version": "1.12.0",
+  "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, edge traffic and bots, and incident triage.",
   "author": {
     "name": "Salesforce"
   },
@@ -14,7 +14,8 @@
     "operations",
     "administration",
     "runbooks",
-    "incident-triage"
+    "incident-triage",
+    "ecdn"
   ],
   "skills": "./skills/",
   "interface": {

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/README.md

@@ -10,6 +10,7 @@ the B2C MCP. No demo workspace or application source is required.
 | `b2c-job-health`           | Review scheduled work and investigate failed or incomplete updates.                       |
 | `b2c-checkout-triage`      | Investigate broader checkout/payment symptoms and select relevant evidence.               |
 | `b2c-order-failure-triage` | Enumerate FAILED orders, quantify impact, and correlate failed inputs with logs and jobs. |
+| `b2c-edge-traffic-triage`  | Classify bot and abusive eCDN traffic, check edge protections, and propose rule changes.  |
 
 See the [Operations guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/operations)
 for setup and example requests. Direct plugin installation adds guidance; it

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "b2c-ops",
-  "version": "1.10.3",
-  "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, and incident triage.",
+  "version": "1.12.0",
+  "description": "B2C Commerce operator and administrator runbooks for job health, checkout and failed orders, edge traffic and bots, and incident triage.",
   "author": {
     "name": "Salesforce"
   },
@@ -15,7 +15,8 @@
     "operations",
     "administration",
     "runbooks",
-    "incident-triage"
+    "incident-triage",
+    "ecdn"
   ],
   "extensions": {
     "com.openai": {

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-checkout-triage/SKILL.md

@@ -29,9 +29,9 @@ update process for live customer impact; do not wait for exact counts to escalat
 | Order records                | Discover Admin Orders contracts via code mode                    | A response enum does not establish supported status filters. See [failed-order triage](skill://b2c-ops/b2c-order-failure-triage/SKILL.md) for the demonstrated OCAPI fallback. |
 | Affected products/attributes | SCAPI Admin product reads; live schemas for tenant custom fields | Compare known IDs and selected fields. Shopper contracts are reference-only in this runtime.                                                                                   |
 | Suspected import/integration | [b2c-job-health](skill://b2c-ops/b2c-job-health/SKILL.md)        | Read the chosen job's log and check its actual data effects.                                                                                                                   |
-| Traffic/latency context      | Code mode Metrics where enabled; CLI `b2c metrics`               | Feature access and scopes vary. CIP/CCAC trends: `cip_discover` / `cip_query` after [CIP guidance](skill://mcp/cip/SKILL.md), with freshness/coverage limits. CLI fallback: `b2c cip`.                                                          |
+| Traffic/latency context      | Code mode Metrics where enabled; CLI `b2c metrics`               | Feature access and scopes vary. CIP/CCAC trends: `cip_discover` / `cip_query` after [CIP guidance](skill://mcp/b2c-mcp-cip/SKILL.md), with freshness/coverage limits. CLI fallback: `b2c cip`.                                                          |
 
-Read `skill://mcp/scapi/SKILL.md` before code mode; prefer dedicated tools when
+Read `skill://mcp/b2c-mcp-scapi/SKILL.md` before code mode; prefer dedicated tools when
 available. Discover operations/required fields before requests, compose bounded
 reads, and return selected evidence with errors and continuation. Read only the
 conditional reference needed; native assistants can use installed skill names.

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-edge-traffic-triage/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: b2c-edge-traffic-triage
+description: Investigate bot activity, scrapers, crawlers or abusive traffic hitting a B2C Commerce storefront through the eCDN (CDN edge). Review WAF, firewall and rate-limiting protections, correlate available traffic evidence, and propose narrowly scoped rule changes for approval.
+---
+
+# Edge traffic and bot triage
+
+Outcome: identify which automated traffic matters, whether current edge
+protections cover it, and a proposed, approved next step. Inspection never
+authorizes blocking, challenging, or changing zone settings.
+
+## Scope and impact
+
+Resolve the instance with `config_inspect` (CLI: `b2c setup inspect`). List the
+tenant's zones first and focus on production storefront zones; ask when the
+target zone is ambiguous. Use a fixed UTC window (propose the last 7 days if
+none is given) and record the symptom: origin load or errors, scraping, login or
+token abuse, basket/inventory abuse, or a routine review. Record impact and
+owner; follow the team's incident process for live customer impact.
+
+## Access and tools
+
+| Evidence                 | Preferred MCP path                                                                                                                                              | CLI fallback                                                                                      |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| Zones                    | Code mode `getZonesInfo` (`cdn/zones/v1`)                                                                                                                       | `b2c ecdn zones list`                                                                             |
+| Edge protections         | Code mode reads of security settings, custom firewall rules, rate-limiting rules, managed WAF rulesets                                                          | `b2c ecdn security get`, `b2c ecdn firewall list`, `b2c ecdn rate-limit list`, `b2c ecdn waf ...` |
+| Edge traffic attribution | Discover read operations for edge traffic or analytics with `scapi_search` (`api: "cdn/zones/v1"`, prefer `schemas: "live"`); use only what the contract offers | Logpush jobs (`listLogpushJob`; `b2c ecdn logpush jobs list`) show where raw edge logs already go |
+| Edge volume and errors   | `metrics_get` with `category: "ecdn"` where the Metrics API is enabled                                                                                          | `b2c metrics ecdn`                                                                                |
+| Origin impact            | `logs_list_files` / `logs_get_recent`                                                                                                                           | `b2c logs get`                                                                                    |
+
+Read `skill://mcp/b2c-mcp-scapi/SKILL.md` before code mode; the zone APIs need
+`sfcc.cdn-zones` (writes `sfcc.cdn-zones.rw`). If no traffic operation is
+available to this tenant or client, say that edge attribution is unavailable
+through the toolkit and continue with protections, Logpush and origin evidence.
+Never infer traffic volume from rule configuration alone.
+
+## Checks and decisions
+
+1. Keep executions small: one or two zones per `scapi_execute`, fixed `from`/`to`,
+   small result limits. Executions stop at 30 s; split work rather than retry a
+   timed-out batch whole.
+2. Classify sources by user agent, ASN, IP, host, path, status and cache result:
+   verified crawlers and link previews, monitoring or integrations, unverified
+   automation (headless browsers, HTTP libraries, empty user agents), and
+   scanning or exploit probes. A user agent is self-reported; corroborate it.
+3. Before proposing action on a high-volume source, ask who runs it. Synthetic
+   monitors, performance tests, feeds and Salesforce services often look like bots.
+4. Prioritize traffic that reaches origin or sensitive paths (login, token,
+   basket, checkout, search). Mostly cached automation has lower origin cost.
+5. Compare sources with protections: rules in a non-enforcing mode (monitor,
+   simulate, log), disabled managed rules, thresholds above observed rates,
+   and rules scoped to other hosts or paths. Report gaps, not only matches.
+
+## Mitigation and recovery
+
+Propose the narrowest change (host, path, ASN or verified-bot condition) and a
+non-enforcing or challenge step before a block. Changes need explicit approval
+and are subject to Safety Mode. After a change, re-check the same evidence over
+a fresh equivalent window and keep a rollback (previous rule state). Rule
+syntax and CLI options: native `b2c-ecdn`, MCP `skill://b2c-cli/b2c-ecdn/SKILL.md`
+and its `references/SECURITY.md`.
+
+## Escalation and handoff
+
+Summarize zones, window, top sources with counts and share, the evidence source
+and its limits, matching rules and gaps, proposed changes, and next owner.
+Route suspected attacks with customer impact to the security owner and
+Salesforce Support. Use native `b2c-production-triage` or the MCP
+[case template](skill://b2c-ops/b2c-production-triage/references/escalation.md).

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-job-health/SKILL.md

@@ -20,14 +20,14 @@ an incident. Do not invent impact from a red status alone.
 
 ## Access and tools
 
-| Evidence                     | Preferred MCP path                                               | CLI fallback                                                 |
-| ---------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------ |
-| Execution history and steps  | `builtin/job-execution-review` / `builtin/job-execution-inspect` in code mode                                     | `b2c job search`; check `--help` for filters                 |
-| Known execution log          | `webdav_get` with the returned `logFilePath` | `b2c job log JOB_ID EXECUTION_ID`                            |
-| Expected product/data change | Discover the relevant Admin operation and select affected fields | Relevant CLI/data workflow if supported                      |
-| Code-version clues           | `builtin/code-version-inspect` in code mode                  | `b2c code list`; modification time is not activation history |
+| Evidence                     | Preferred MCP path                                                            | CLI fallback                                                 |
+| ---------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| Execution history and steps  | `builtin/job-execution-review` / `builtin/job-execution-inspect` in code mode | `b2c job search`; check `--help` for filters                 |
+| Known execution log          | `webdav_get` with the returned `logFilePath`                                  | `b2c job log JOB_ID EXECUTION_ID`                            |
+| Expected product/data change | Discover the relevant Admin operation and select affected fields              | Relevant CLI/data workflow if supported                      |
+| Code-version clues           | `builtin/code-version-inspect` in code mode                                   | `b2c code list`; modification time is not activation history |
 
-Read `skill://mcp/scapi/SKILL.md` before code mode. Use its search/discovery
+Read `skill://mcp/b2c-mcp-scapi/SKILL.md` before code mode. Use its search/discovery
 contract; project/instance context belongs on tool calls. Authentication is
 managed. Do not export tokens or use ambient fetch inside code mode.
 
@@ -61,6 +61,11 @@ idempotency, duplicate exports/messages, and rollback limits. Inspect uncertain
 outcomes before retrying; never replay a whole code-mode program after writes.
 Verify business data as well as terminal job status after intervention.
 
+To start a rerun (for example a search-index rebuild) from MCP, use code mode
+`createJobExecution`; system jobs need their own body, not `parameters`:
+`skill://mcp/b2c-mcp-scapi/references/jobs.md#start-a-job`. CLI:
+`b2c job run ID --wait --body '{"site_scope":["Site"]}'` (see `b2c-cli:b2c-job`).
+
 ## Escalation and handoff
 
 Summarize job/execution/step IDs, impact/window, status, affected inputs, log
@@ -72,4 +77,4 @@ No source access is required; case submission needs authorization.
 
 CLI-specific detail when needed: native `b2c-job`, MCP
 `skill://b2c-cli/b2c-job/SKILL.md`, or the
-[Jobs reference](https://salesforcecommercecloud.github.io/b2c-developer-tooling/cli/jobs).
+[Jobs reference](https://salesforcecommercecloud.github.io/b2c-developer-tooling/cli/jobs.md) (`b2c docs read cli-jobs`).

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-order-failure-triage/SKILL.md

@@ -28,7 +28,7 @@ process. Counts describe indexed orders, not all checkout attempts or conversion
 
 Read [order-search recipe](references/order-evidence.md) before counting: it
 defines the site grant/index prerequisites, bounded request bodies, auth handling,
-and fault interpretation. For code mode, first read `skill://mcp/scapi/SKILL.md`.
+and fault interpretation. For code mode, first read `skill://mcp/b2c-mcp-scapi/SKILL.md`.
 If external requests are unavailable, report that evidence gap and continue with
 logs; do not deploy an OrderMgr endpoint to obtain access.
 

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-order-failure-triage/references/order-evidence.md

@@ -19,13 +19,13 @@ Custom API just to gain inspection access.
 Use configured hostname, site ID, and client ID from `config_inspect` or
 `b2c setup inspect`. Obtain an AM token through the CLI's `b2c auth token --json`
 for an external request, keeping it in memory and out of output/files. If using
-the MCP token helper, read `skill://mcp/scapi/references/tokens.md`; token export
+the MCP token helper, read `skill://mcp/b2c-mcp-scapi/references/tokens.md`; token export
 is only for the external client, never required for managed SCAPI calls.
 MCP Safety Mode does not protect an independently executed HTTP request.
 
 The OAuth client needs the site's OCAPI Shop resource grant for `POST /order_search`
 and a usable order search index. Use the
-[authentication guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/authentication)
+[authentication guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/authentication.md) (`b2c docs read guide-authentication`)
 and `docs_search` for current OCAPI Settings/order indexing instructions. Have
 the user authorize any grant or index maintenance; do not perform it to satisfy
 a read request.

package/node_modules/@salesforce/b2c-agent-plugins/b2c-ops/skills/b2c-production-triage/SKILL.md

@@ -25,12 +25,12 @@ every available signal.
 ## Access and tools
 
 - Establish access: MCP, terminal/CLI, logs, data, source. Operator work does not
-  require a cartridge checkout. Credentials/setup issues: MCP `mcp/b2c-config`
+  require a cartridge checkout. Credentials/setup issues: MCP `mcp/b2c-mcp-config`
   section `setup-and-access`; native `b2c-config`/`b2c-auth`, or the
-  [authentication guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/authentication).
+  [authentication guide](https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/authentication.md) (`b2c docs read guide-authentication`).
 
 Prefer dedicated MCP tools; discover available names once. Read
-`skill://mcp/scapi/SKILL.md` before using `scapi_search`/`scapi_execute`, as those
+`skill://mcp/b2c-mcp-scapi/SKILL.md` before using `scapi_search`/`scapi_execute`, as those
 tools require. Read only the matching runbook/reference, not every linked skill.
 Native assistants use the installed skill name; MCP can read these URIs or use
 `skills_read` with `collection: "b2c-ops"` and a task query.
@@ -41,8 +41,9 @@ Native assistants use the installed skill name; MCP can read these URIs or use
 | Failed job or stale data                                  | Code mode `codemode.describe("builtin/failed-job-triage")`, then run with fixed `from`/`to` -> execution IDs and `logFilePath` -> log tools | [Job health](skill://b2c-ops/b2c-job-health/SKILL.md) covers continuation, step details, exact WebDAV logs, and green-but-incomplete runs.                                        |
 | Checkout failures or orders down                          | Custom logs -> determine whether failures produce order records -> relevant data/traffic evidence                                           | [Checkout triage](skill://b2c-ops/b2c-checkout-triage/SKILL.md) distinguishes checkout symptoms from failed-order records.                                                   |
 | Find/count FAILED orders or investigate affected products | Verify Admin filter support; otherwise external OCAPI Shop order search -> safe IDs -> logs and selected Admin product reads                | [Failed-order triage](skill://b2c-ops/b2c-order-failure-triage/SKILL.md) owns enumeration, count/sample limits, and the workaround. No OCAPI helper exists inside code mode. |
+| Bot, scraper or abusive traffic; edge 403/429 spikes | Zone protections and available edge traffic evidence via code mode `cdn/zones/v1` | [Edge traffic triage](skill://b2c-ops/b2c-edge-traffic-triage/SKILL.md) classifies sources, checks owners, and finds protection gaps before any rule change. |
 | Suspected code change                                     | Code mode `builtin/code-version-inspect`: active/rollback versions and activation/modification timestamps                                                                             | Current metadata is not a complete activation history. Corroborate with release records.                                                             |
-| Runtime-only defect                                       | [MCP debugger](skill://mcp/debugger/SKILL.md) on an authorized reproduction target                                                          | Operator handoff is valid without source access. Do not halt production requests for routine triage.                                                                         |
+| Runtime-only defect                                       | [MCP debugger](skill://mcp/b2c-mcp-debugger/SKILL.md) on an authorized reproduction target                                                          | Operator handoff is valid without source access. Do not halt production requests for routine triage.                                                                         |
 
 ## Checks and decisions
 

package/node_modules/@salesforce/b2c-agent-plugins/figma-to-sfnext-pagedesigner/README.md

@@ -39,12 +39,12 @@ For file-copy install to any supported IDE, use `b2c setup skills figma-to-sfnex
 The skill asks for a Figma frame URL (must include `node-id`), a Storefront Next repo URL or local path, and a Page Designer group (palette folder). It then:
 
 1. Splits the frame into one Page Designer block per visual section.
-2. Shows you the authorable fields and default values for each block — and a **token reconciliation table** where the design diverges from your `brand.css` — then waits for your approval before writing any code.
-3. Generates React + Tailwind components using your project's brand tokens, adds Page Designer decorator metadata with defaults pre-filled from the Figma copy, and wires up SCAPI product loaders for catalog-backed sections.
-4. Registers each component, commits, and pushes.
+2. Shows you the authorable fields and default values for each block — and a **token reconciliation table** where the design diverges from your theme tokens (`src/theme/tokens/`) — then waits for your approval before writing any code.
+3. Generates React + Tailwind components using your project's brand tokens, adds Page Designer decorator metadata with defaults pre-filled from the Figma copy, and wires up product loaders for catalog-backed sections.
+4. Verifies each component in the generated registry, generates and validates the cartridge, and deploys it (`pnpm cartridge:deploy`) and the bundle (`pnpm push`) when you ask.
 5. Validates design fidelity in the browser (when a browser MCP is available).
 
-After CI runs (MRT deploy + cartridge deploy), the new blocks appear in the Business Manager Page Designer palette with fields pre-filled from the Figma design.
+After the cartridge and bundle are deployed, the new blocks appear in the Business Manager Page Designer palette with fields pre-filled from the Figma design.
 
 ## What's included