package json config sourcce

Author: clavery

packages/b2c-tooling-sdk/src/cli/base-command.ts

@@ -218,6 +218,11 @@ export abstract class BaseCommand<T extends typeof Command> extends Command {
    * Plugin sources are collected into two arrays based on their priority:
    * - `pluginSourcesBefore`: High priority sources (override defaults)
    * - `pluginSourcesAfter`: Low priority sources (fill gaps)
+   *
+   * Priority mapping:
+   * - 'before' → -1 (higher priority than defaults)
+   * - 'after' → 10 (lower priority than defaults)
+   * - number → used directly
    */
   protected async collectPluginConfigSources(): Promise<void> {
     // Access flags that may be defined in subclasses (OAuthCommand, InstanceCommand)
@@ -241,10 +246,28 @@ export abstract class BaseCommand<T extends typeof Command> extends Command {
       const result = success.result as ConfigSourcesHookResult | undefined;
       if (!result?.sources?.length) continue;
 
-      if (result.priority === 'before') {
+      // Map priority: 'before' → -1, 'after' → 10, number → as-is, undefined → 10
+      const numericPriority =
+        result.priority === 'before'
+          ? -1
+          : result.priority === 'after'
+            ? 10
+            : typeof result.priority === 'number'
+              ? result.priority
+              : 10; // default 'after'
+
+      // Apply priority to sources that don't already have one set
+      for (const source of result.sources) {
+        if (source.priority === undefined) {
+          (source as {priority?: number}).priority = numericPriority;
+        }
+      }
+
+      // Still use before/after arrays for backwards compatibility
+      // The resolver will sort all sources by priority anyway
+      if (numericPriority < 0) {
         this.pluginSourcesBefore.push(...result.sources);
       } else {
-        // Default priority is 'after'
         this.pluginSourcesAfter.push(...result.sources);
       }
     }

packages/b2c-tooling-sdk/src/cli/hooks.ts

@@ -71,14 +71,22 @@ export interface ConfigSourcesHookResult {
   /** Config sources to add to the resolution chain */
   sources: ConfigSource[];
   /**
-   * Where to insert sources relative to default sources.
+   * Priority for the returned sources. Can be a string or number:
    *
-   * - `'before'`: Higher priority than dw.json/~/.mobify (plugin overrides defaults)
-   * - `'after'`: Lower priority than defaults (plugin fills gaps)
+   * String values (legacy, still supported):
+   * - `'before'`: Maps to priority -1 (higher priority than defaults)
+   * - `'after'`: Maps to priority 10 (lower priority than defaults)
    *
-   * @default 'after'
+   * Numeric values (preferred):
+   * - Any number. Lower numbers = higher priority.
+   * - Built-in sources use priority 0.
+   * - package.json uses priority 1000.
+   *
+   * If a source already has a `priority` property set, it will not be overridden.
+   *
+   * @default 'after' (maps to 10)
    */
-  priority?: 'before' | 'after';
+  priority?: 'before' | 'after' | number;
 }
 
 /**

packages/b2c-tooling-sdk/src/config/resolver.ts

@@ -14,7 +14,7 @@
 import type {AuthCredentials} from '../auth/types.js';
 import type {B2CInstance} from '../instance/index.js';
 import {mergeConfigsWithProtection, getPopulatedFields, createInstanceFromConfig} from './mapping.js';
-import {DwJsonSource, MobifySource} from './sources/index.js';
+import {DwJsonSource, MobifySource, PackageJsonSource} from './sources/index.js';
 import type {
   ConfigSource,
   ConfigSourceInfo,
@@ -125,10 +125,13 @@ export class ConfigResolver {
   /**
    * Creates a new ConfigResolver.
    *
-   * @param sources - Custom configuration sources. If not provided, uses default sources (dw.json, ~/.mobify).
+   * @param sources - Custom configuration sources. If not provided, uses default sources (dw.json, ~/.mobify, package.json).
+   *                  Sources are automatically sorted by priority (lower number = higher priority).
    */
   constructor(sources?: ConfigSource[]) {
-    this.sources = sources ?? [new DwJsonSource(), new MobifySource()];
+    const configSources = sources ?? [new DwJsonSource(), new MobifySource(), new PackageJsonSource()];
+    // Sort sources by priority (lower number = higher priority, undefined = 0)
+    this.sources = [...configSources].sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
   }
 
   /**
@@ -355,21 +358,22 @@ export function resolveConfig(
 ): ResolvedB2CConfig {
   // Build sources list with priority ordering:
   // 1. sourcesBefore (high priority - override defaults)
-  // 2. default sources (dw.json, ~/.mobify)
+  // 2. default sources (dw.json, ~/.mobify, package.json)
   // 3. sourcesAfter (low priority - fill gaps)
   let sources: ConfigSource[];
 
   if (options.replaceDefaultSources) {
-    // Replace mode: only use provided sources (no default dw.json/~/.mobify)
+    // Replace mode: only use provided sources (no default dw.json/~/.mobify/package.json)
     sources = [...(options.sourcesBefore ?? []), ...(options.sourcesAfter ?? [])];
   } else {
     // Normal mode: before + defaults + after
-    const defaultSources: ConfigSource[] = [new DwJsonSource(), new MobifySource()];
+    const defaultSources: ConfigSource[] = [new DwJsonSource(), new MobifySource(), new PackageJsonSource()];
 
-    // Combine: sourcesBefore > defaults > sourcesAfter
+    // Combine all sources
     sources = [...(options.sourcesBefore ?? []), ...defaultSources, ...(options.sourcesAfter ?? [])];
   }
 
+  // ConfigResolver constructor will sort by priority
   const resolver = new ConfigResolver(sources);
   const {config, warnings, sources: sourceInfos} = resolver.resolve(overrides, options);
 

packages/b2c-tooling-sdk/src/config/sources/dw-json-source.ts

@@ -21,6 +21,7 @@ import {getLogger} from '../../logging/logger.js';
  */
 export class DwJsonSource implements ConfigSource {
   readonly name = 'DwJsonSource';
+  readonly priority = 0;
 
   load(options: ResolveConfigOptions): ConfigLoadResult | undefined {
     const logger = getLogger();

packages/b2c-tooling-sdk/src/config/sources/index.ts

@@ -10,3 +10,4 @@
  */
 export {DwJsonSource} from './dw-json-source.js';
 export {MobifySource} from './mobify-source.js';
+export {PackageJsonSource} from './package-json-source.js';

packages/b2c-tooling-sdk/src/config/sources/mobify-source.ts

@@ -39,6 +39,7 @@ interface MobifyConfigFile {
  */
 export class MobifySource implements ConfigSource {
   readonly name = 'MobifySource';
+  readonly priority = 0;
 
   load(options: ResolveConfigOptions): ConfigLoadResult | undefined {
     const logger = getLogger();

packages/b2c-tooling-sdk/src/config/sources/package-json-source.ts

@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * package.json configuration source.
+ *
+ * Reads configuration from the `b2c` key in package.json.
+ * Only loads from cwd (project root), not from parent directories.
+ *
+ * @internal This module is internal to the SDK. Use ConfigResolver instead.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type {ConfigSource, ConfigLoadResult, ResolveConfigOptions, NormalizedConfig} from '../types.js';
+import {getPopulatedFields} from '../mapping.js';
+import {getLogger} from '../../logging/logger.js';
+
+/**
+ * Fields allowed to be configured in package.json.
+ * These are non-sensitive, non-instance-specific configuration.
+ */
+const ALLOWED_FIELDS: (keyof NormalizedConfig)[] = [
+  'shortCode',
+  'clientId',
+  'mrtProject',
+  'mrtOrigin',
+  'accountManagerHost',
+];
+
+/**
+ * Structure of the b2c config in package.json
+ */
+interface PackageJsonB2CConfig {
+  shortCode?: string;
+  clientId?: string;
+  mrtProject?: string;
+  mrtOrigin?: string;
+  accountManagerHost?: string;
+  [key: string]: unknown;
+}
+
+/**
+ * Configuration source that loads from package.json `b2c` key.
+ *
+ * This source has the lowest priority (1000) and only provides
+ * non-sensitive, project-level defaults.
+ *
+ * @internal
+ */
+export class PackageJsonSource implements ConfigSource {
+  readonly name = 'PackageJsonSource';
+  readonly priority = 1000;
+
+  load(options: ResolveConfigOptions): ConfigLoadResult | undefined {
+    const logger = getLogger();
+
+    // Only look in cwd (or startDir if provided)
+    const searchDir = options.startDir ?? process.cwd();
+    const packageJsonPath = path.join(searchDir, 'package.json');
+
+    logger.trace({location: packageJsonPath}, '[PackageJsonSource] Checking for package.json');
+
+    if (!fs.existsSync(packageJsonPath)) {
+      logger.trace('[PackageJsonSource] No package.json found');
+      return undefined;
+    }
+
+    try {
+      const content = fs.readFileSync(packageJsonPath, 'utf8');
+      const packageJson = JSON.parse(content) as {b2c?: PackageJsonB2CConfig};
+
+      if (!packageJson.b2c) {
+        logger.trace('[PackageJsonSource] No b2c key in package.json');
+        return undefined;
+      }
+
+      const b2cConfig = packageJson.b2c;
+      const config: NormalizedConfig = {};
+
+      // Only copy allowed fields
+      for (const field of ALLOWED_FIELDS) {
+        const value = b2cConfig[field];
+        if (value !== undefined) {
+          (config as Record<string, unknown>)[field] = value;
+        }
+      }
+
+      // Warn about disallowed fields
+      const disallowedFields = Object.keys(b2cConfig).filter(
+        (key) => !ALLOWED_FIELDS.includes(key as keyof NormalizedConfig),
+      );
+      if (disallowedFields.length > 0) {
+        logger.warn(
+          {disallowedFields},
+          '[PackageJsonSource] Ignoring sensitive/instance-specific fields in package.json b2c config',
+        );
+      }
+
+      const fields = getPopulatedFields(config);
+      if (fields.length === 0) {
+        logger.trace('[PackageJsonSource] b2c key present but no allowed fields populated');
+        return undefined;
+      }
+
+      logger.trace({location: packageJsonPath, fields}, '[PackageJsonSource] Loaded config');
+
+      return {config, location: packageJsonPath};
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      logger.trace({location: packageJsonPath, error: message}, '[PackageJsonSource] Failed to parse package.json');
+      return undefined;
+    }
+  }
+}

packages/b2c-tooling-sdk/src/config/types.ts

@@ -183,6 +183,19 @@ export interface ConfigSource {
   /** Human-readable name for diagnostics */
   name: string;
 
+  /**
+   * Priority for source ordering. Lower numbers = higher priority.
+   *
+   * Recommended ranges:
+   * - < 0: Before built-in sources (override defaults)
+   * - 0: Built-in sources (DwJsonSource, MobifySource)
+   * - 1-999: After built-in sources (fill gaps)
+   * - 1000: Lowest priority (PackageJsonSource)
+   *
+   * @default 0
+   */
+  priority?: number;
+
   /**
    * Load configuration from this source.
    *

packages/b2c-tooling-sdk/test/config/resolver.test.ts

@@ -17,11 +17,16 @@ import {
  * Mock config source for testing.
  */
 class MockSource implements ConfigSource {
+  public priority?: number;
+
   constructor(
     public name: string,
     private config: NormalizedConfig | undefined,
     private location?: string,
-  ) {}
+    priority?: number,
+  ) {
+    this.priority = priority;
+  }
 
   load(_options: ResolveConfigOptions): ConfigLoadResult | undefined {
     if (this.config === undefined) {
@@ -353,4 +358,86 @@ describe('config/resolver', () => {
       expect(config.hostname).to.equal('test.demandware.net');
     });
   });
+
+  describe('priority-based sorting', () => {
+    it('sorts sources by priority (lower number = higher priority)', () => {
+      // Sources added in wrong order, but should be sorted by priority
+      const lowPriority = new MockSource('low', {clientId: 'low-client'}, undefined, 100);
+      const highPriority = new MockSource('high', {clientId: 'high-client'}, undefined, -10);
+      const defaultPriority = new MockSource('default', {clientId: 'default-client'}, undefined, 0);
+
+      // Pass sources in "wrong" order - they should get sorted
+      const resolver = new ConfigResolver([lowPriority, defaultPriority, highPriority]);
+      const {config} = resolver.resolve();
+
+      // High priority source (-10) wins
+      expect(config.clientId).to.equal('high-client');
+    });
+
+    it('treats undefined priority as 0', () => {
+      const withPriority = new MockSource('with', {clientId: 'with-priority'}, undefined, 10);
+      const noPriority = new MockSource('no', {clientId: 'no-priority'}, undefined, undefined);
+
+      // No priority (=0) should win over priority 10
+      const resolver = new ConfigResolver([withPriority, noPriority]);
+      const {config} = resolver.resolve();
+
+      expect(config.clientId).to.equal('no-priority');
+    });
+
+    it('maintains insertion order for same priority', () => {
+      const first = new MockSource('first', {clientId: 'first-client'}, undefined, 0);
+      const second = new MockSource('second', {clientId: 'second-client'}, undefined, 0);
+
+      const resolver = new ConfigResolver([first, second]);
+      const {config} = resolver.resolve();
+
+      // First source should win since both have same priority
+      expect(config.clientId).to.equal('first-client');
+    });
+
+    it('negative priorities come before 0', () => {
+      const before = new MockSource('before', {hostname: 'before.com'}, undefined, -1);
+      const builtin = new MockSource('builtin', {hostname: 'builtin.com'}, undefined, 0);
+
+      const resolver = new ConfigResolver([builtin, before]);
+      const {config} = resolver.resolve();
+
+      // -1 priority should win
+      expect(config.hostname).to.equal('before.com');
+    });
+
+    it('high priorities (1000) come last', () => {
+      const packageJson = new MockSource('package', {shortCode: 'package-code'}, undefined, 1000);
+      const dwJson = new MockSource('dwjson', {shortCode: 'dw-code'}, undefined, 0);
+
+      const resolver = new ConfigResolver([packageJson, dwJson]);
+      const {config} = resolver.resolve();
+
+      // 0 priority should win over 1000
+      expect(config.shortCode).to.equal('dw-code');
+    });
+
+    it('plugin priorities work with before/after pattern', () => {
+      // Simulating: plugin 'before' (-1), builtin (0), plugin 'after' (10)
+      const pluginBefore = new MockSource('plugin-before', {clientId: 'before-client'}, undefined, -1);
+      const builtin = new MockSource('builtin', {clientId: 'builtin-client', hostname: 'builtin.com'}, undefined, 0);
+      const pluginAfter = new MockSource(
+        'plugin-after',
+        {clientId: 'after-client', mrtProject: 'after-project'},
+        undefined,
+        10,
+      );
+
+      const resolver = new ConfigResolver([pluginAfter, builtin, pluginBefore]);
+      const {config} = resolver.resolve();
+
+      // 'before' plugin wins for clientId
+      expect(config.clientId).to.equal('before-client');
+      // builtin provides hostname (not in before plugin)
+      expect(config.hostname).to.equal('builtin.com');
+      // 'after' plugin provides mrtProject (not in others)
+      expect(config.mrtProject).to.equal('after-project');
+    });
+  });
 });