This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@salesforce/b2c-cli@1.22.0

Minor Changes

• #615 1f553b3 - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks @clavery!)

• #611 62db97f - Add support for creating multiple sandbox clones from a single source in one request (1 to many cloning). (Thanks @charithaT07!)

  • b2c sandbox clone create now accepts --target-count <1-5> to create a batch of clones sharing the same source, TTL, profile, and notification emails. --wait polls every clone in the batch until each reaches a terminal state.
  • b2c sandbox clone list supports --batch-id to filter clones belonging to a specific batch.
  • b2c sandbox clone get and the VS Code extension's clone details view now show the batch ID and sibling clone IDs when a clone was created as part of a batch.
  • The VS Code extension's "Clone Sandbox" command prompts for the number of clones to create and reports aggregate progress across the batch.

• #574 8d096d0 - Add Authorization Code + PKCE support for browser-based OAuth (public clients) and make it the default for the user auth method, replacing the legacy implicit flow in the default chain. The default auth-method order is now client-credentials, jwt, user. The implicit flow is still selectable via --auth-methods implicit (or in dw.json) for backwards compatibility but emits a deprecation warning — OAuth 2.1 deprecates implicit for public clients. (Thanks @clavery!)

  b2c auth login now uses Authorization Code + PKCE by default and persists a refresh token alongside the access token, so subsequent commands silently refresh without re-opening the browser. The new --auth-methods flag on b2c auth login lets you opt back into the legacy implicit flow (--auth-methods implicit). The POC b2c auth pkce command has been removed; use b2c auth login instead.

  dw.json gains a "user-auth": true shorthand for "auth-methods": ["user"]. It is mutually exclusive with "auth-methods" — setting both is rejected during config mapping.

  To smooth the migration, the user flow includes a transitional safety net: if the configured Account Manager client is not a PKCE-capable public client, it automatically falls back to the implicit flow for that client and logs a deprecation warning recommending you create a new public (PKCE) client and use it. (An AM client's type cannot be changed after creation, so a legacy implicit-only client must be replaced, not converted.) Set SFCC_DISABLE_PKCE_FALLBACK=1 to disable the fallback and surface PKCE failures directly. This fallback is temporary and will be removed once public clients have migrated.

  Persisted browser-auth sessions (which now hold long-lived PKCE refresh tokens) are written 0o600 in a 0o700 directory, so they are no longer world-readable.

  The VS Code extension persists PKCE refresh tokens via OS-keychain-backed SecretStorage (with a sync-snapshot/async-write-through cache), keeping behavior compatible with the unified AuthSessionBackend used by the CLI.

Patch Changes

• #604 2de9046 - cap:install now warns and prompts for confirmation before installing a Commerce App from a non-Salesforce provider. Use --force to skip the prompt (e.g. in CI or scripted installs); the prompt is also skipped automatically in --json mode. (Thanks @jbisaSF!)

• Updated dependencies [1f553b3, d5551f3, 62db97f, 8d096d0, 2de9046]:

  • @salesforce/b2c-tooling-sdk@1.22.0

@salesforce/b2c-tooling-sdk@1.22.0

Minor Changes

• #615 1f553b3 - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks @clavery!)

• #611 62db97f - Add support for creating multiple sandbox clones from a single source in one request (1 to many cloning). (Thanks @charithaT07!)

  • b2c sandbox clone create now accepts --target-count <1-5> to create a batch of clones sharing the same source, TTL, profile, and notification emails. --wait polls every clone in the batch until each reaches a terminal state.
  • b2c sandbox clone list supports --batch-id to filter clones belonging to a specific batch.
  • b2c sandbox clone get and the VS Code extension's clone details view now show the batch ID and sibling clone IDs when a clone was created as part of a batch.
  • The VS Code extension's "Clone Sandbox" command prompts for the number of clones to create and reports aggregate progress across the batch.

• #574 8d096d0 - Add Authorization Code + PKCE support for browser-based OAuth (public clients) and make it the default for the user auth method, replacing the legacy implicit flow in the default chain. The default auth-method order is now client-credentials, jwt, user. The implicit flow is still selectable via --auth-methods implicit (or in dw.json) for backwards compatibility but emits a deprecation warning — OAuth 2.1 deprecates implicit for public clients. (Thanks @clavery!)

  b2c auth login now uses Authorization Code + PKCE by default and persists a refresh token alongside the access token, so subsequent commands silently refresh without re-opening the browser. The new --auth-methods flag on b2c auth login lets you opt back into the legacy implicit flow (--auth-methods implicit). The POC b2c auth pkce command has been removed; use b2c auth login instead.

  dw.json gains a "user-auth": true shorthand for "auth-methods": ["user"]. It is mutually exclusive with "auth-methods" — setting both is rejected during config mapping.

  To smooth the migration, the user flow includes a transitional safety net: if the configured Account Manager client is not a PKCE-capable public client, it automatically falls back to the implicit flow for that client and logs a deprecation warning recommending you create a new public (PKCE) client and use it. (An AM client's type cannot be changed after creation, so a legacy implicit-only client must be replaced, not converted.) Set SFCC_DISABLE_PKCE_FALLBACK=1 to disable the fallback and surface PKCE failures directly. This fallback is temporary and will be removed once public clients have migrated.

  Persisted browser-auth sessions (which now hold long-lived PKCE refresh tokens) are written 0o600 in a 0o700 directory, so they are no longer world-readable.

  The VS Code extension persists PKCE refresh tokens via OS-keychain-backed SecretStorage (with a sync-snapshot/async-write-through cache), keeping behavior compatible with the unified AuthSessionBackend used by the CLI.

Patch Changes

• #605 d5551f3 - Refresh the bundled documentation corpora to the 26.8 release so b2c docs (Thanks [@clavery](https://github.com/clavery)!) search/docs read and the MCP docs_* tools surface the latest content:

  • Script API reference and XSD schemas updated to DWAPP 26.8 (adds the
    dw.commerceapps package, connection-health hooks, and ShippingHooks).

  • Developer Center guides refreshed (adds newly published guides such as SCAPI
    CDN caching, guest order access codes, and several Storefront Next topics).

    Each corpus index now records where it came from so maintainers can spot the
    delta before a refresh: git-sourced prose corpora store the upstream commit
    (source block) and DWAPP-sourced corpora store the platform release
    (platformDocVersion, e.g. "DWAPP 26.8").

• #604 2de9046 - cap:install now warns and prompts for confirmation before installing a Commerce App from a non-Salesforce provider. Use --force to skip the prompt (e.g. in CI or scripted installs); the prompt is also skipped automatically in --json mode. (Thanks @jbisaSF!)

b2c-vs-extension@1.1.0

Minor Changes

• #611 62db97f - Add support for creating multiple sandbox clones from a single source in one request (1 to many cloning). (Thanks @charithaT07!)
  • b2c sandbox clone create now accepts --target-count <1-5> to create a batch of clones sharing the same source, TTL, profile, and notification emails. --wait polls every clone in the batch until each reaches a terminal state.
  • b2c sandbox clone list supports --batch-id to filter clones belonging to a specific batch.
  • b2c sandbox clone get and the VS Code extension's clone details view now show the batch ID and sibling clone IDs when a clone was created as part of a batch.
  • The VS Code extension's "Clone Sandbox" command prompts for the number of clones to create and reports aggregate progress across the batch.

Patch Changes

• #574 8d096d0 - Add Authorization Code + PKCE support for browser-based OAuth (public clients) and make it the default for the user auth method, replacing the legacy implicit flow in the default chain. The default auth-method order is now client-credentials, jwt, user. The implicit flow is still selectable via --auth-methods implicit (or in dw.json) for backwards compatibility but emits a deprecation warning — OAuth 2.1 deprecates implicit for public clients. (Thanks @clavery!)

  b2c auth login now uses Authorization Code + PKCE by default and persists a refresh token alongside the access token, so subsequent commands silently refresh without re-opening the browser. The new --auth-methods flag on b2c auth login lets you opt back into the legacy implicit flow (--auth-methods implicit). The POC b2c auth pkce command has been removed; use b2c auth login instead.

  dw.json gains a "user-auth": true shorthand for "auth-methods": ["user"]. It is mutually exclusive with "auth-methods" — setting both is rejected during config mapping.

  To smooth the migration, the user flow includes a transitional safety net: if the configured Account Manager client is not a PKCE-capable public client, it automatically falls back to the implicit flow for that client and logs a deprecation warning recommending you create a new public (PKCE) client and use it. (An AM client's type cannot be changed after creation, so a legacy implicit-only client must be replaced, not converted.) Set SFCC_DISABLE_PKCE_FALLBACK=1 to disable the fallback and surface PKCE failures directly. This fallback is temporary and will be removed once public clients have migrated.

  Persisted browser-auth sessions (which now hold long-lived PKCE refresh tokens) are written 0o600 in a 0o700 directory, so they are no longer world-readable.

  The VS Code extension persists PKCE refresh tokens via OS-keychain-backed SecretStorage (with a sync-snapshot/async-write-through cache), keeping behavior compatible with the unified AuthSessionBackend used by the CLI.

• Updated dependencies [1f553b3, d5551f3, 62db97f, 8d096d0, 2de9046]:

  • @salesforce/b2c-tooling-sdk@1.22.0

@salesforce/b2c-dx-mcp@1.9.4

Patch Changes

• Updated dependencies [1f553b3, d5551f3, 62db97f, 8d096d0, 2de9046]:
  • @salesforce/b2c-tooling-sdk@1.22.0

@salesforce/b2c-dx-docs@0.3.18

Patch Changes

• #615 1f553b3 - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks @clavery!)

• #615 1f553b3 - Added the data migrations plugin to the third-party plugins guide so users can discover idempotent, version-controlled IMPEX and scripted deployments. (Thanks @clavery!)

@salesforce/b2c-agent-plugins@1.7.1

Patch Changes

• #615 1f553b3 - Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. (Thanks @clavery!)

• #609 af06784 - Fix six cross-pack skill links in b2c-scapi-admin and b2c-scapi-shopper that were one directory level short and resolved to paths that do not exist. (Thanks @dkatashev!)