SalesforceCommerceCloud · github-actions · Aug 12, 2026 · Aug 12, 2026
@@ -1 +1 @@
-Fri Jul 31 14:50:35 UTC 2026
+Wed Aug 12 20:55:21 UTC 2026
@@ -17,7 +17,7 @@
       "source": "./skills/b2c-cli",
       "category": "productivity",
       "strict": false,
-      "version": "1.7.0"
+      "version": "1.8.0"
     },
     {
       "name": "b2c",
@@ -29,7 +29,7 @@
       "source": "./skills/b2c",
       "category": "productivity",
       "strict": false,
-      "version": "1.7.0"
+      "version": "1.8.0"
     },
     {
       "name": "b2c-dx-mcp",
@@ -41,7 +41,7 @@
       "source": "./plugins/b2c-dx-mcp",
       "category": "productivity",
       "strict": false,
-      "version": "1.9.3"
+      "version": "1.10.0"
     },
     {
       "name": "storefront-next",
@@ -53,7 +53,7 @@
       "source": "./skills/storefront-next",
       "category": "productivity",
       "strict": false,
-      "version": "1.7.0"
+      "version": "1.8.0"
     },
     {
       "name": "storefront-next-figma",

@@ -1,5 +1,15 @@
 # @salesforce/b2c-dx-docs
 
+## 0.3.18
+
+### Patch Changes
+
+- [#615](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/615) [`1f553b3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/1f553b3e26c57909ce654b61e25f4db537111312) - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#615](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/615) [`1f553b3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/1f553b3e26c57909ce654b61e25f4db537111312) - Added the data migrations plugin to the third-party plugins guide so users can discover idempotent, version-controlled IMPEX and scripted deployments. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#618](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/618) [`abec39f`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/abec39fbc4843b00c426c6fc2ac26492e67df11d) - Update the embedded B2C Commerce Script API TypeScript definitions from version 26.7 to 26.9 so IDE IntelliSense reflects the latest platform APIs. (Thanks [@clavery](https://github.com/clavery)!)
+
 ## 0.3.17
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/b2c-dx-docs",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "private": true,
   "description": "Documentation for B2C Developer Tooling",
   "scripts": {

@@ -1,5 +1,40 @@
 # @salesforce/b2c-cli
 
+## 1.22.0
+
+### Minor Changes
+
+- [#615](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/615) [`1f553b3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/1f553b3e26c57909ce654b61e25f4db537111312) - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#611](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/611) [`62db97f`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/62db97fefb40e56c12f41d54803db7315ec8c33a) - Add support for creating multiple sandbox clones from a single source in one request (1 to many cloning). (Thanks [@charithaT07](https://github.com/charithaT07)!)
+  - `b2c sandbox clone create` now accepts `--target-count <1-5>` to create a batch of clones sharing the same source, TTL, profile, and notification emails. `--wait` polls every clone in the batch until each reaches a terminal state.
+  - `b2c sandbox clone list` supports `--batch-id` to filter clones belonging to a specific batch.
+  - `b2c sandbox clone get` and the VS Code extension's clone details view now show the batch ID and sibling clone IDs when a clone was created as part of a batch.
+  - The VS Code extension's "Clone Sandbox" command prompts for the number of clones to create and reports aggregate progress across the batch.
+
+- [#574](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/574) [`8d096d0`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/8d096d01a2f70eb979f1b6b246fd196b77f2acd0) - Add Authorization Code + PKCE support for browser-based OAuth (public clients) and make it the default for the `user` auth method, replacing the legacy `implicit` flow in the default chain. The default auth-method order is now `client-credentials`, `jwt`, `user`. The implicit flow is still selectable via `--auth-methods implicit` (or in dw.json) for backwards compatibility but emits a deprecation warning — OAuth 2.1 deprecates implicit for public clients. (Thanks [@clavery](https://github.com/clavery)!)
+
+  `b2c auth login` now uses Authorization Code + PKCE by default and persists a refresh token alongside the access token, so subsequent commands silently refresh without re-opening the browser. The new `--auth-methods` flag on `b2c auth login` lets you opt back into the legacy implicit flow (`--auth-methods implicit`). The POC `b2c auth pkce` command has been removed; use `b2c auth login` instead.
+
+  dw.json gains a `"user-auth": true` shorthand for `"auth-methods": ["user"]`. It is mutually exclusive with `"auth-methods"` — setting both is rejected during config mapping.
+
+  To smooth the migration, the `user` flow includes a transitional safety net: if the configured Account Manager client is not a PKCE-capable public client, it automatically falls back to the implicit flow for that client and logs a deprecation warning recommending you create a new public (PKCE) client and use it. (An AM client's type cannot be changed after creation, so a legacy implicit-only client must be replaced, not converted.) Set `SFCC_DISABLE_PKCE_FALLBACK=1` to disable the fallback and surface PKCE failures directly. This fallback is temporary and will be removed once public clients have migrated.
+
+  Persisted browser-auth sessions (which now hold long-lived PKCE refresh tokens) are written `0o600` in a `0o700` directory, so they are no longer world-readable.
+
+  The VS Code extension persists PKCE refresh tokens via OS-keychain-backed `SecretStorage` (with a sync-snapshot/async-write-through cache), keeping behavior compatible with the unified `AuthSessionBackend` used by the CLI.
+
+### Patch Changes
+
+- [#613](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/613) [`c0ec3f6`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c0ec3f6202ca8ee69676ae2361e8b276cd69385c) - `b2c setup inspect` now redacts the JWT private key passphrase (`jwtPassphrase`) by default, matching the other secret fields. Use `--unmask` to show it. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#618](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/618) [`abec39f`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/abec39fbc4843b00c426c6fc2ac26492e67df11d) - Update the embedded B2C Commerce Script API TypeScript definitions from version 26.7 to 26.9 so IDE IntelliSense reflects the latest platform APIs. (Thanks [@clavery](https://github.com/clavery)!)
+
+- [#604](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/604) [`2de9046`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/2de904636dad1b1f23a80da8b640dc8acd6e97f3) - `cap:install` now warns and prompts for confirmation before installing a Commerce App from a non-Salesforce provider. Use `--force` to skip the prompt (e.g. in CI or scripted installs); the prompt is also skipped automatically in `--json` mode. (Thanks [@jbisaSF](https://github.com/jbisaSF)!)
+
+- Updated dependencies [[`1f553b3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/1f553b3e26c57909ce654b61e25f4db537111312), [`d5551f3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/d5551f351836f12d2c167459441093671bcad9bc), [`c0ec3f6`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c0ec3f6202ca8ee69676ae2361e8b276cd69385c), [`62db97f`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/62db97fefb40e56c12f41d54803db7315ec8c33a), [`8d096d0`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/8d096d01a2f70eb979f1b6b246fd196b77f2acd0), [`2de9046`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/2de904636dad1b1f23a80da8b640dc8acd6e97f3)]:
+  - @salesforce/b2c-tooling-sdk@1.22.0
+
 ## 1.21.4
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/b2c-cli",
   "description": "A Salesforce B2C Commerce CLI",
-  "version": "1.21.4",
+  "version": "1.22.0",
   "author": "Charles Lavery",
   "bin": {
     "b2c": "./bin/run.js"

@@ -1,5 +1,16 @@
 # @salesforce/b2c-dx-mcp
 
+## 1.10.0
+
+### Minor Changes
+
+- [#613](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/613) [`c0ec3f6`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c0ec3f6202ca8ee69676ae2361e8b276cd69385c) - Add a `config_inspect` MCP tool that reports the resolved configuration (instance, auth, SCAPI/MRT settings) with the source of each value and the effective project directory — secrets are redacted by default. Filesystem tools now resolve the project directory with explicit precedence (per-call argument, then `--project-directory`/`SFCC_PROJECT_DIRECTORY`, then the process working directory) and echo the resolved directory back in their output, so agents can override it per call and see which directory was used across MCP clients that spawn the server from inconsistent working directories. (Thanks [@clavery](https://github.com/clavery)!)
+
+### Patch Changes
+
+- Updated dependencies [[`1f553b3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/1f553b3e26c57909ce654b61e25f4db537111312), [`d5551f3`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/d5551f351836f12d2c167459441093671bcad9bc), [`c0ec3f6`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/c0ec3f6202ca8ee69676ae2361e8b276cd69385c), [`62db97f`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/62db97fefb40e56c12f41d54803db7315ec8c33a), [`8d096d0`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/8d096d01a2f70eb979f1b6b246fd196b77f2acd0), [`2de9046`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/2de904636dad1b1f23a80da8b640dc8acd6e97f3)]:
+  - @salesforce/b2c-tooling-sdk@1.22.0
+
 ## 1.9.3
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/b2c-dx-mcp",
   "description": "MCP server for B2C Commerce developer experience tools",
-  "version": "1.9.3",
+  "version": "1.10.0",
   "author": "Salesforce",
   "license": "Apache-2.0",
   "repository": "SalesforceCommerceCloud/b2c-developer-tooling",
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		Fri Jul 31 14:50:35 UTC 2026
		Wed Aug 12 20:55:21 UTC 2026