Add Custom APIs endpoint status command and SDK support

[clavery]

Summary

• Add b2c scapi custom status CLI command to view Custom API endpoint registration status
• Add Custom APIs SDK client with OAuth scope encapsulation pattern
• Add OAuthStrategy.withAdditionalScopes() for client-level scope injection
• Add developer skill documenting API client development patterns
• Add new b2c plugin with Custom API development skill for building SCAPI Custom APIs

Changes

SDK (@salesforce/b2c-tooling-sdk)

• New client: createCustomApisClient() - typed client for Custom APIs DX API
• OAuth enhancement: OAuthStrategy.withAdditionalScopes() - creates new strategy with merged scopes
• Tenant utilities: toOrganizationId(), toTenantId(), buildTenantScope() for SCAPI ID handling
• OpenAPI spec: Added specs/custom-apis-v1.yaml with generated types

CLI (@salesforce/b2c-cli)

• New command: b2c scapi custom status --tenant-id <ID>
  • Lists all Custom API endpoints for an organization
  • Shows type (Admin/Shopper), API name, path, method, status
  • Filter by status (--status active|not_registered)
  • Group by type or site (--group-by type|site)
  • Customizable columns (--columns, --extended)
  • JSON output (--json)
  • Rolls up endpoints by site for cleaner display

Plugins & Skills

• New plugin: b2c - B2C Commerce development skills
  • b2c-custom-api-development skill - comprehensive guide for building SCAPI Custom APIs
    • Covers the three required components (contract, implementation, mapping)
    • OAS 3.0 schema authoring with ShopperToken vs AmOAuth2 security schemes
    • Implementation patterns with RESTResponseMgr
    • Caching and remote includes
    • Circuit breaker protection
    • Troubleshooting workflow and common errors
• Updated: b2c-cli plugin with b2c-scapi-custom skill for the status command

Documentation

• CLI reference: docs/cli/custom-apis.md
• User skill: plugins/b2c-cli/skills/b2c-scapi-custom/SKILL.md
• Developer skill: .claude/skills/api-client-development/SKILL.md
• Custom API development skill: plugins/b2c/skills/b2c-custom-api-development/SKILL.md

Design Highlights

Scope encapsulation: The SDK client internally handles OAuth scope requirements using withAdditionalScopes(). CLI commands simply pass through the auth strategy without managing scopes, keeping auth concerns in the SDK layer.

// CLI command - simple, no scope management
const client = createCustomApisClient({shortCode, tenantId}, oauthStrategy);

// SDK client internally adds required scopes
const scopedAuth = auth.withAdditionalScopes([...CUSTOM_APIS_DEFAULT_SCOPES, buildTenantScope(tenantId)]);

Skill separation: The b2c plugin focuses on development practices (how to build Custom APIs), while the b2c-cli plugin focuses on CLI operations (how to use the commands). This allows agents to combine skills for a complete workflow.

Test plan

• SDK tests pass: pnpm --filter @salesforce/b2c-tooling-sdk run test
• CLI tests pass: pnpm --filter @salesforce/b2c-cli run test
• Build passes: pnpm run build
• Manual test: ./cli scapi custom status --tenant-id <test-tenant>