Merge remote-tracking branch 'origin/main' into feature/debug-mcp

# Conflicts:
#	docs/cli/debug.md

Author: clavery

.changeset/asset-query-config.md

@@ -0,0 +1,7 @@
+---
+'@salesforce/b2c-tooling-sdk': minor
+'@salesforce/b2c-cli': minor
+'b2c-vs-extension': minor
+---
+
+Support `assetQuery` as a first-class config field. Set it in `dw.json` (per-instance), in `package.json` under `b2c`, or via `SFCC_ASSET_QUERY` to control which JSON dot-paths are extracted as assets during content library parsing. The VS Code Content Libraries tree and `b2c content export` both honor it automatically; the `--asset-query` flag still wins when provided, and the fallback remains `["image.path"]`.

.changeset/cli-debug-docs-link.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-cli': patch
+---
+
+`b2c debug --help` now deep-links to the Debug command reference page on the docs site.

.changeset/docs-audit-fixes.md

@@ -0,0 +1,14 @@
+---
+'@salesforce/b2c-dx-docs': patch
+---
+
+Documentation audit pass: corrected mismatched flags and missing commands across the CLI reference. Highlights:
+
+- Documented `b2c sandbox ips`, `b2c mrt env var push`, and `b2c debug` (previously omitted).
+- Fixed `mrt project get/update/delete` examples to use the required positional slug; corrected `mrt project member add/update --role` to integer values; replaced `mrt env invalidate --path` with the actual `--pattern` flag; corrected `mrt env redirect create/delete/clone` flag names; rewrote `mrt user api-key` and `mrt user email-prefs` against the real flags.
+- Rewrote `ecdn zones create`, `ecdn cache purge`, `ecdn security update`, `ecdn speed update`, and `ecdn logpush jobs create` flag tables to match source.
+- Removed phantom flags (`--display-name`, etc.) from `am users update`.
+- Standardized Node.js requirement on `>=22.16.0` across all installation guides.
+- `account-manager` guide no longer recommends the unsupported `client_secret_post`; the `authentication` warning was reframed as guidance toward `client_secret_basic`.
+- Added a Copilot section to the agent-skills guide so the homepage Copilot link points at meaningful content.
+- Filled gaps in the CLI command-topic index (`bm-roles`, `setup`, `ecdn`, `replications`, `scapi-schemas`, `cap`, `logs`).

.changeset/docs-default-user-scope.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-dx-docs': patch
+---
+
+Updated plugin install examples to default to user scope

.changeset/improve-skill-descriptions.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-agent-plugins': patch
+---
+
+Improve skill trigger accuracy: rewrite b2c-scapi-admin and b2c-site-import-export descriptions, merge b2c-users-roles into b2c-am, fix weak eval prompts for b2c-job

.changeset/late-papayas-taste.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/mrt-utilities': patch
+---
+
+Keep ACH header in request

.changeset/ods-enhancements.md

@@ -0,0 +1,10 @@
+---
+'@salesforce/b2c-cli': minor
+'@salesforce/b2c-dx-docs': patch
+---
+
+ODS CLI: **`b2c sandbox create`** adds **`--emails`** for notification addresses; **`b2c sandbox update`** adds **`--start-scheduler`**, **`--stop-scheduler`**, **`--clear-start-scheduler`**, and **`--clear-stop-scheduler`**; **`b2c realm update`** adds **`--emails`**, **`--start-scheduler`**, **`--stop-scheduler`**, **`--clear-start-scheduler`**, and **`--clear-stop-scheduler`**.
+
+Sandbox API: **`b2c sandbox operations list`** and **`b2c sandbox operations get`** (inspect lifecycle operations); **`b2c sandbox alias get`** (get one alias by ID, same endpoint as **`alias list --alias-id`**).
+
+User guide updated for scheduling flags, sandbox operations, and **`b2c sandbox alias get`**.

.changeset/vscode-content-tree-instance-switch.md

@@ -0,0 +1,5 @@
+---
+'b2c-vs-extension': patch
+---
+
+Fix Content Libraries tree not updating when switching instances. The tree previously kept libraries from the old instance; it now re-seeds from the newly active instance's configured `contentLibrary` on switch.

.changeset/vscode-safety-middleware.md

@@ -0,0 +1,5 @@
+---
+'b2c-vs-extension': minor
+---
+
+Enforce Safety Mode in the VS Code extension. Destructive operations initiated from the extension (sandbox delete/stop/restart, WebDAV writes, jobs, etc.) now honor `SFCC_SAFETY_LEVEL`, `SFCC_SAFETY_CONFIRM`, `SFCC_SAFETY_CONFIG`, and the per-instance `safety` block in `dw.json`, consistent with the CLI. Every extension command is also evaluated against command rules (e.g. `{ "command": "b2c-dx.sandbox.delete", "action": "block" }`), and confirmation-mode policies surface a native VS Code modal before the command runs.

docs/.vitepress/config.mts

@@ -106,9 +106,9 @@ const referenceSidebar = [
       {text: 'CIP', link: '/cli/cip'},
       {text: 'CAP (Commerce Apps)', link: '/cli/cap'},
       {text: 'Code', link: '/cli/code'},
-      {text: 'Debug', link: '/cli/debug'},
       {text: 'Content', link: '/cli/content'},
       {text: 'Custom APIs', link: '/cli/custom-apis'},
+      {text: 'Debug', link: '/cli/debug'},
       {text: 'Docs', link: '/cli/docs'},
       {text: 'eCDN', link: '/cli/ecdn'},
       {text: 'Jobs', link: '/cli/jobs'},