Merge remote-tracking branch 'upstream/main' into W-21766978-Add-scheduling-user-email

Author: charithaT07

.changeset/code-deploy-activate-flag.md

@@ -111,7 +111,7 @@ jobs:
         if: steps.release-type.outputs.type == 'nightly' || (steps.changesets.outputs.skip != 'true' && steps.quick-check.outputs.skip != 'true')
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: 22
+          node-version: '22.22.1'
           cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 

.github/workflows/publish.yml

@@ -49,6 +49,7 @@ const guidesSidebar = [
       {text: 'Analytics Reports (CIP/CCAC)', link: '/guide/analytics-reports-cip-ccac'},
       {text: 'IDE Integration', link: '/guide/ide-integration'},
       {text: 'Scaffolding', link: '/guide/scaffolding'},
+      {text: 'Safety Mode', link: '/guide/safety'},
       {text: 'Security', link: '/guide/security'},
       {text: 'Storefront Next', link: '/guide/storefront-next'},
       {text: 'MRT Utilities', link: '/guide/mrt-utilities'},

docs/.vitepress/config.mts

@@ -1,5 +1,11 @@
 # @salesforce/b2c-dx-docs
 
+## 0.2.13
+
+### Patch Changes
+
+- [#318](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/318) [`6880a84`](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/6880a846aacd029a1eb510023aa76f4b844ec26e) - Added per-instance safety configuration with rule-based actions (allow/block/confirm) and interactive confirmation mode. Safety can now be configured in `dw.json` with granular rules for HTTP paths, job IDs, and CLI commands. (Thanks [@clavery](https://github.com/clavery)!)
+
 ## 0.2.12
 
 ### Patch Changes

docs/CHANGELOG.md

@@ -51,7 +51,7 @@ b2c sandbox list                 # ✅ Allowed
 b2c sandbox create --realm test  # ❌ Blocked
 ```
 
-Safety Mode operates at the HTTP layer and cannot be bypassed by command-line flags. See the [Security Guide](/guide/security#operational-security-safety-mode) for detailed information.
+Safety Mode operates at the HTTP layer and cannot be bypassed by command-line flags. See the [Safety Mode](/guide/safety) guide for detailed information.
 
 ### Other Environment Variables
 

docs/cli/index.md

@@ -615,6 +615,79 @@ If detailed usage data is present (granular history, profiles, etc.), the comman
 
 ---
 
+## b2c sandbox settings
+
+Show effective OCAPI and WebDAV settings for a specific sandbox.
+
+### Usage
+
+```bash
+b2c sandbox settings <SANDBOXID>
+```
+
+### Arguments
+
+| Argument | Description | Required |
+|----------|-------------|----------|
+| `SANDBOXID` | Sandbox ID (UUID or realm-instance, e.g., `zzzv-123`) | Yes |
+
+### Examples
+
+```bash
+# Show settings summary for a sandbox
+b2c sandbox settings zzzz-001
+
+# Output full settings payload as JSON
+b2c sandbox settings zzzz-001 --json
+```
+
+### Output
+
+When not using `--json`, the command prints:
+
+- Number of OCAPI client entries
+- Number of WebDAV client entries
+- A short per-client breakdown for each settings type
+
+---
+
+## b2c sandbox storage
+
+Show filesystem storage usage for a specific sandbox.
+
+### Usage
+
+```bash
+b2c sandbox storage <SANDBOXID>
+```
+
+### Arguments
+
+| Argument | Description | Required |
+|----------|-------------|----------|
+| `SANDBOXID` | Sandbox ID (UUID or realm-instance, e.g., `zzzv-123`) | Yes |
+
+### Examples
+
+```bash
+# Show storage table for a sandbox
+b2c sandbox storage zzzz-001
+
+# Output raw storage response as JSON
+b2c sandbox storage zzzz-001 --json
+```
+
+### Output
+
+When not using `--json`, the command prints a table with one row per filesystem:
+
+- Filesystem name
+- Total space (MB)
+- Used space (MB)
+- Used percentage
+
+---
+
 ## Sandbox Aliases
 
 Sandbox aliases let you access a sandbox via a custom hostname instead of the default instance hostname.
@@ -976,56 +1049,86 @@ For the complete response including all metadata, use the `--json` flag.
 
 ## Realm-Level Commands
 
-Realm commands operate at the **realm** level rather than on an individual sandbox. They are available as both `realm` topic commands and as `sandbox realm` subcommands:
+Realm commands operate at the **realm** level rather than on an individual sandbox. Use them under the existing sandbox topics:
 
-- `b2c realm list` (`b2c sandbox realm list`)
-- `b2c realm get` (`b2c sandbox realm get`)
-- `b2c realm update` (`b2c sandbox realm update`)
-- `b2c realm usage` (`b2c sandbox realm usage`)
+- `b2c sandbox realm list` (or `b2c ods realm list`)
+- `b2c sandbox realm configuration` (or `b2c ods realm configuration`)
+- `b2c sandbox realm get` (or `b2c ods realm get`)
+- `b2c sandbox realm update` (or `b2c ods realm update`)
+- `b2c sandbox realm usage` (or `b2c ods realm usage`)
+- `b2c sandbox realm usages` (or `b2c ods realm usages`)
 
 ### Required Access for Realm Commands
 
-To run `b2c realm` commands, your user or API client must have **realm‑level access** in Account Manager (typically a role ending in `_sbx` for sandbox management).
+To run `b2c sandbox realm` (or `b2c ods realm`) commands, your user or API client must have **realm‑level access** in Account Manager (typically a role ending in `_sbx` for sandbox management).
 
-### b2c realm list
+### b2c sandbox realm list
 
 List realms eligible for sandbox management.
 
 #### Usage
 
 ```bash
-b2c realm list [REALM]
+b2c sandbox realm list [REALM]
 ```
 
 #### Arguments
 
 | Argument | Description | Required |
 |----------|-------------|----------|
-| `REALM` | Specific realm ID (four-letter ID) to get details for | No |
+| `REALM` | Optional realm ID filter (four-letter ID) | No |
 
 #### Examples
 
 ```bash
 # List all realms you can manage
-b2c realm list
+b2c sandbox realm list
 
 # List a single realm
-b2c realm list zzzz
+b2c sandbox realm list zzzz
 
 # JSON output
-b2c realm list --json
+b2c sandbox realm list --json
 ```
 
-When `REALM` is omitted, the command discovers realms from the `/me` endpoint and then fetches configuration for each.
+When `REALM` is omitted, the command discovers realms from the `/me` endpoint.
+
+### b2c sandbox realm configuration
 
-### b2c realm get
+Get sandbox configuration for a specific realm.
+
+#### Usage
+
+```bash
+b2c sandbox realm configuration <REALM>
+```
+
+#### Arguments
+
+| Argument | Description | Required |
+|----------|-------------|----------|
+| `REALM` | Realm ID (four-letter ID) | Yes |
+
+#### Examples
+
+```bash
+# Get realm sandbox configuration
+b2c sandbox realm configuration zzzz
+
+# JSON output
+b2c sandbox realm configuration zzzz --json
+```
+
+When not using `--json`, the command prints configuration details such as emails, sandbox limits, TTL values, and start/stop schedulers.
+
+### b2c sandbox realm get
 
 Get detailed information about a specific realm, including configuration.
 
 #### Usage
 
 ```bash
-b2c realm get <REALM>
+b2c sandbox realm get <REALM>
 ```
 
 #### Arguments
@@ -1038,10 +1141,10 @@ b2c realm get <REALM>
 
 ```bash
 # Get realm details
-b2c realm get zzzz
+b2c sandbox realm get zzzz
 
 # JSON output (includes configuration and account details when available)
-b2c realm get zzzz --json
+b2c sandbox realm get zzzz --json
 ```
 
 #### Output
@@ -1058,14 +1161,14 @@ The command prints:
   - Whether local users are allowed
   - Start/stop scheduler definitions (as JSON) when present
 
-### b2c realm update
+### b2c sandbox realm update
 
 Update realm‑level sandbox configuration for TTL and start/stop schedulers.
 
 #### Usage
 
 ```bash
-b2c realm update <REALM> [FLAGS]
+b2c sandbox realm update <REALM> [FLAGS]
 ```
 
 #### Arguments
@@ -1096,30 +1199,30 @@ The scheduler flags expect a JSON value or the literal string `"null"`:
 
 ```bash
 # Set max TTL to unlimited and default TTL to 24 hours
-b2c realm update zzzz --max-sandbox-ttl 0 --default-sandbox-ttl 24
+b2c sandbox realm update zzzz --max-sandbox-ttl 0 --default-sandbox-ttl 24
 
 # Configure weekday start/stop schedules
-b2c realm update zzzz \
+b2c sandbox realm update zzzz \
   --start-scheduler '{"weekdays":["MONDAY","TUESDAY"],"time":"08:00:00Z"}' \
   --stop-scheduler '{"weekdays":["MONDAY","TUESDAY"],"time":"19:00:00Z"}'
 
 # Remove an existing stop scheduler
-b2c realm update zzzz --stop-scheduler "null"
+b2c sandbox realm update zzzz --stop-scheduler "null"
 
 # Update realm emails and local user setting
 b2c realm update zzzz --emails dev@example.com,ops@example.com --local-users-allowed
 ```
 
 If no update flags are provided, the command fails with a helpful error explaining which flags can be used.
 
-### b2c realm usage
+### b2c sandbox realm usage
 
 Show usage information for a realm across all sandboxes in that realm.
 
 #### Usage
 
 ```bash
-b2c realm usage <REALM> [FLAGS]
+b2c sandbox realm usage <REALM> [FLAGS]
 ```
 
 #### Arguments
@@ -1141,13 +1244,13 @@ b2c realm usage <REALM> [FLAGS]
 
 ```bash
 # Realm usage for a recent window
-b2c realm usage zzzz
+b2c sandbox realm usage zzzz
 
 # Realm usage for a specific range
-b2c realm usage zzzz --from 2024-01-01 --to 2024-01-31
+b2c sandbox realm usage zzzz --from 2024-01-01 --to 2024-01-31
 
 # Daily granularity with full JSON response
-b2c realm usage zzzz --granularity daily --detailed-report --json
+b2c sandbox realm usage zzzz --granularity daily --detailed-report --json
 ```
 
 When not using `--json`, the command prints a summary including:
@@ -1159,3 +1262,46 @@ When not using `--json`, the command prints a summary including:
 
 If detailed usage is available, it prints a hint to re-run with `--json` for the full structure. If no usage data is returned for the requested period, it prints a friendly message instead of failing.
 
+### b2c sandbox realm usages
+
+Show usage information for multiple realms in one request.
+
+#### Usage
+
+```bash
+b2c sandbox realm usages [FLAGS]
+```
+
+#### Flags
+
+| Flag | Description |
+|------|-------------|
+| `--realm` | Realm IDs to include (repeat flag or provide comma-separated values) |
+| `--from` | Earliest date to include in usage (ISO 8601) |
+| `--to` | Latest date to include in usage (ISO 8601) |
+| `--detailed-report` | Include detailed usage information in the response |
+
+If `--realm` is omitted, the command auto-discovers realms from `/me` and queries usage for all discovered realms.
+
+#### Examples
+
+```bash
+# Usage for all realms available to the current user
+b2c sandbox realm usages
+
+# Usage for two specific realms
+b2c sandbox realm usages --realm zzzz --realm yyyy
+
+# Usage for comma-separated realms and date range
+b2c sandbox realm usages --realm zzzz,yyyy --from 2024-01-01 --to 2024-01-31
+
+# Detailed report in JSON
+b2c sandbox realm usages --detailed-report --json
+```
+
+When not using `--json`, the command prints one row per realm with summary metrics such as:
+
+- Active / created / deleted sandbox counts
+- Minutes up / minutes down
+- Sandbox seconds
+

docs/cli/sandbox.md

@@ -84,7 +84,9 @@ You can configure the CLI using environment variables:
 | `MRT_PROJECT`                 | MRT project slug (`SFCC_MRT_PROJECT` also supported)           |
 | `MRT_ENVIRONMENT`             | MRT environment name (`SFCC_MRT_ENVIRONMENT`, `MRT_TARGET` also supported) |
 | `MRT_CLOUD_ORIGIN`            | MRT API origin URL override (`SFCC_MRT_CLOUD_ORIGIN` also supported) |
-| `SFCC_SAFETY_LEVEL`           | Safety mode: `NONE`, `NO_DELETE`, `NO_UPDATE`, `READ_ONLY` (see [Safety Mode](/guide/security#operational-security-safety-mode)) |
+| `SFCC_SAFETY_LEVEL`           | Safety mode: `NONE`, `NO_DELETE`, `NO_UPDATE`, `READ_ONLY` (see [Safety Mode](/guide/safety)) |
+| `SFCC_SAFETY_CONFIRM`         | Enable confirmation mode for safety: `true` or `1` (see [Safety Mode](/guide/safety#confirmation-mode)) |
+| `SFCC_SAFETY_CONFIG`          | Path to global safety config file (see [Safety Mode](/guide/safety#global-safety-config)) |
 
 ## .env File
 
@@ -150,6 +152,8 @@ For projects that work with multiple instances, use the `configs` array:
 }
 ```
 
+Each instance can have its own `safety` configuration for per-instance operational safety. See [Safety Mode](/guide/safety#per-instance-configuration) for details.
+
 Use the `-i` or `--instance` flag to select a specific configuration:
 
 ```bash