@crombolo/backoffice-host 0.9.1 → 0.11.0

package/plugin/bundles-marketplace.js

@@ -7,11 +7,13 @@
  * an Umbraco package does not install into this CMS anyway.
  *
  * What it shows instead is the npm registry, searched for the keyword a crombolo
- * bundle publishes, and filtered to the ones that really declare backoffice
- * extensions. Installing runs `bun add` on the server.
+ * bundle publishes, and filtered to the ones whose manifest is a valid bundle.
+ * Installing runs `bun add` on the server, then adds the content the bundle
+ * carries unless the site or the person installing declines it.
  */
 import { css, html, nothing, repeat } from '@umbraco-cms/backoffice/external/lit'
 import { UmbLitElement } from '@umbraco-cms/backoffice/lit-element'
+import { carriesTags } from './bundles-carries.js'
 import { installBundle, searchMarketplace } from './bundles-client.js'
 
 export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
@@ -23,6 +25,8 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
     _notice: { state: true },
     _keyword: { state: true },
     _url: { state: true },
+    _appliesContent: { state: true },
+    _declined: { state: true },
   }
 
   constructor() {
@@ -35,6 +39,8 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
     this._keyword = 'crombolo-bundle'
     this._url = ''
     this._query = ''
+    this._appliesContent = true
+    this._declined = new Set()
   }
 
   connectedCallback() {
@@ -50,6 +56,7 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
       this._items = result.items ?? []
       this._keyword = result.keyword ?? this._keyword
       this._url = result.url ?? ''
+      this._appliesContent = result.appliesContent !== false
     } catch (error) {
       this._error = error instanceof Error ? error.message : String(error)
     } finally {
@@ -66,13 +73,14 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
     this._busy = item.name
     this._notice = ''
     try {
-      const outcome = await installBundle(item.name, item.version)
+      const outcome = await installBundle(item.name, item.version, !this._declined.has(item.name))
       // The dependency line is what there is to commit, so it is shown rather
       // than described: the install lives in this node's node_modules until it
       // is in the site's repository.
-      this._notice = outcome.dependency
+      const installed = outcome.dependency
         ? `${outcome.message} — "${outcome.dependency.name}": "${outcome.dependency.range}"`
         : (outcome.message ?? '')
+      this._notice = outcome.content ? `${installed} ${outcome.content.message}` : installed
       if (outcome.ok) await this.#load()
     } catch (error) {
       this._notice = error instanceof Error ? error.message : String(error)
@@ -81,6 +89,25 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
     }
   }
 
+  #toggleContent(item, event) {
+    const declined = new Set(this._declined)
+    if (event.target.checked) declined.delete(item.name)
+    else declined.add(item.name)
+    this._declined = declined
+  }
+
+  #contentChoice(item) {
+    if (!item.carries?.content || item.installedVersion) return nothing
+    if (!this._appliesContent)
+      return html`<p class="meta">Its content is added separately on this site.</p>`
+    return html`
+      <uui-toggle
+        label="Add its content when installing"
+        .checked=${!this._declined.has(item.name)}
+        @change=${(event) => this.#toggleContent(item, event)}></uui-toggle>
+    `
+  }
+
   #empty() {
     return html`
       <uui-box headline="No bundles published yet">
@@ -120,6 +147,7 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
                   <uui-box>
                     <div slot="headline">${item.name} <small>${item.version}</small></div>
                     <p>${item.description || 'No description.'}</p>
+                    <p class="carries">${carriesTags(item.carries)}</p>
                     <p class="meta">
                       ${item.publisher ? html`<span>by ${item.publisher}</span>` : nothing}
                       <a href=${item.links.npm} target="_blank" rel="noopener">npm</a>
@@ -129,6 +157,7 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
                           : nothing
                       }
                     </p>
+                    ${this.#contentChoice(item)}
                     ${
                       item.installedVersion
                         ? html`<uui-tag look="positive">Installed ${item.installedVersion}</uui-tag>`
@@ -193,6 +222,14 @@ export default class CromboloBundlesMarketplaceElement extends UmbLitElement {
       opacity: 0.7;
       font-weight: normal;
     }
+    .carries {
+      display: flex;
+      gap: var(--uui-size-space-2, 6px);
+    }
+    uui-toggle {
+      display: block;
+      margin-bottom: var(--uui-size-space-4, 12px);
+    }
   `
 }
 

package/plugin/changes-dashboard.js

@@ -6,6 +6,9 @@
  * Findings arrive from two sources — a pending upgrade and an arriving content
  * bundle — so they are grouped rather than pooled: the counts of one say nothing
  * about the other, and the actions that resolve them are different.
+ *
+ * Below them, each installed bundle that keeps data of its own lists the
+ * changes it has made to its storage here, and any still to make.
  */
 import { css, html, LitElement, nothing } from '@umbraco-cms/backoffice/external/lit'
 import { fetchReport } from './report-client.js'
@@ -57,7 +60,7 @@ export default class CromboloChangesDashboardElement extends LitElement {
   render() {
     if (this._error) return html`<uui-box headline="Changes"><p>${this._error}</p></uui-box>`
     if (!this._report) return html`<uui-box headline="Changes"><uui-loader></uui-loader></uui-box>`
-    const { health, findings, counts } = this._report
+    const { health, findings, counts, bundles = [] } = this._report
     const shown = findings.filter((f) => this._showResolved || f.status === 'open')
     return html`
       <uui-box headline="Changes">
@@ -86,10 +89,44 @@ export default class CromboloChangesDashboardElement extends LitElement {
             ? html`<p class="empty">Nothing outstanding. <code>crombolo upgrade check</code> and <code>crombolo content check</code> write findings here.</p>`
             : this.#group(shown).map((group) => this.#renderGroup(group))
         }
+        ${bundles.map((bundle) => this.#renderBundle(bundle))}
       </uui-box>
     `
   }
 
+  #renderBundle(bundle) {
+    const steps = [
+      ...bundle.pending.map((step) => ({ ...step, done: false })),
+      ...bundle.applied.map((step) => ({ ...step, done: true })).reverse(),
+    ]
+    return html`
+      <h4>${bundle.name} <small>data storage</small></h4>
+      ${
+        bundle.pending.length > 0
+          ? html`<p><uui-tag color="warning">${bundle.pending.length} change(s) waiting for the next upgrade</uui-tag></p>`
+          : nothing
+      }
+      <uui-table>
+        <uui-table-head>
+          <uui-table-head-cell>Change</uui-table-head-cell>
+          <uui-table-head-cell>Release</uui-table-head-cell>
+          <uui-table-head-cell>State</uui-table-head-cell>
+        </uui-table-head>
+        ${steps.map(
+          (step) => html`<uui-table-row>
+            <uui-table-cell>${step.name}${step.kind === 'contract' ? html`<small>removes data</small>` : nothing}</uui-table-cell>
+            <uui-table-cell>${step.release ?? ''}</uui-table-cell>
+            <uui-table-cell>${
+              step.done
+                ? html`<uui-tag color="positive">done ${step.appliedAt?.slice(0, 10) ?? ''}</uui-tag>`
+                : html`<uui-tag color="warning">waiting</uui-tag>`
+            }</uui-table-cell>
+          </uui-table-row>`,
+        )}
+      </uui-table>
+    `
+  }
+
   #renderGroup(group) {
     return html`
       <h4>

package/plugin/localizations/umbraco-package.json

@@ -2,7 +2,7 @@
   "$schema": "../../../backoffice-dist/dist/umbraco-package-schema.json",
   "name": "Crombolo Localizations",
   "id": "Crombolo.Localizations",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "allowPublicAccess": false,
   "extensions": [
     {

package/plugin/seo/umbraco-package.json

@@ -2,7 +2,7 @@
   "$schema": "../../../backoffice-dist/dist/umbraco-package-schema.json",
   "name": "Crombolo Search & sharing",
   "id": "Crombolo.Seo",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "allowPublicAccess": false,
   "extensions": [
     {

package/plugin/umbraco-package.json

@@ -2,7 +2,7 @@
   "$schema": "../../backoffice-dist/dist/umbraco-package-schema.json",
   "name": "Crombolo",
   "id": "Crombolo.Core",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "allowPublicAccess": false,
   "extensions": [
     {
@@ -79,6 +79,23 @@
         }
       ]
     },
+    {
+      "type": "dashboard",
+      "alias": "Crombolo.Dashboard.AuditLog",
+      "name": "Crombolo Audit Log Dashboard",
+      "element": "/crombolo-plugin/audit-dashboard.js",
+      "weight": 4,
+      "meta": {
+        "label": "Audit log",
+        "pathname": "audit-log"
+      },
+      "conditions": [
+        {
+          "alias": "Umb.Condition.SectionAlias",
+          "match": "Umb.Section.Settings"
+        }
+      ]
+    },
     {
       "type": "dashboard",
       "alias": "Crombolo.Dashboard.Welcome",

package/src/bundle-package.ts

@@ -0,0 +1,266 @@
+/**
+ * A bundle is an npm package whose `package.json` carries the bundle manifest in
+ * its `crombolo` field. `docs/bundles.md`.
+ *
+ * This is the one place that field is read and validated, so discovery, the
+ * marketplace, the server half and the installer cannot disagree about what a
+ * bundle is.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { dirname, isAbsolute, join, normalize, sep } from 'node:path'
+import type { PackageManifestImportmap } from './manifests.ts'
+
+/** The package a bundle declares its peer range on. */
+export const CORE_PACKAGE = '@crombolo/crombolo'
+
+/**
+ * A bundle's id: its route segment, its log name, and the prefix of anything
+ * else it owns. Lowercase, no dots or slashes, so it cannot climb out of a
+ * namespace however it is spelled.
+ */
+export const BUNDLE_ID = /^[a-z][a-z0-9-]{1,38}$/
+
+/** The `content` payload: always `bundle.json` inside the named directory. */
+export const PAYLOAD_MANIFEST = 'bundle.json'
+
+/** An exported binding name: what a site imports to wire the server half. */
+const EXPORT_NAME = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+
+/** The `crombolo` field, as a bundle declares it. */
+export interface CromboloField {
+  id: string
+  name?: string
+  allowPublicAccess?: boolean
+  allowTelemetry?: boolean
+  /** The backoffice half: Umbraco extension manifests. */
+  extensions?: unknown[]
+  importmap?: PackageManifestImportmap
+  /** A directory inside the package holding a `bundle.json` payload. */
+  content?: string
+  /** The factory the package exports for the server half. Never imported by core. */
+  server?: string
+  /**
+   * What this release's table steps promise a running site, for a bundle that
+   * owns tables: `breaking` exactly when it ships a contract.
+   */
+  migrations?: 'compatible' | 'breaking'
+}
+
+/** A bundle as read from its package. */
+export interface BundlePackage {
+  packageName: string
+  version: string
+  directory: string
+  id: string
+  name: string
+  /** `peerDependencies["@crombolo/crombolo"]`. */
+  peerRange: string
+  private: boolean
+  field: CromboloField
+  /** Absolute path of the payload directory, when the bundle carries content. */
+  contentDir: string | undefined
+  carries: { extensions: boolean; content: boolean; server: boolean }
+}
+
+export interface PackageJson {
+  name?: string
+  version?: string
+  private?: boolean
+  dependencies?: Record<string, string>
+  peerDependencies?: Record<string, string>
+  crombolo?: unknown
+}
+
+export function readPackageJson(file: string): PackageJson | undefined {
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8')) as unknown
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? (parsed as PackageJson)
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Whether a package's `crombolo` field declares a bundle at all.
+ *
+ * Core's own umbrella package carries a `crombolo` field too — its release
+ * declaration — so the core package is never a bundle, whatever it holds.
+ */
+export function declaresBundle(json: PackageJson | undefined): boolean {
+  return Boolean(json?.crombolo) && json?.name !== CORE_PACKAGE
+}
+
+/** A relative path that stays inside the package. */
+function insidePackage(directory: string, relative: string): string | undefined {
+  if (relative === '' || isAbsolute(relative) || relative.includes('\0')) return undefined
+  const root = directory.endsWith(sep) ? directory : `${directory}${sep}`
+  const target = normalize(join(directory, relative))
+  return target === normalize(directory) || target.startsWith(root) ? target : undefined
+}
+
+/**
+ * Every reason a package's manifest is not a bundle, reported together.
+ *
+ * `directory` is where the package lives, so `content` can be checked against
+ * what is really there; a packument read from the registry has none, and only
+ * the declaration is checked.
+ */
+export function validateBundlePackage(json: PackageJson, directory?: string): string[] {
+  const problems: string[] = []
+  const field = json.crombolo
+  if (!field || typeof field !== 'object' || Array.isArray(field))
+    return ['its package.json has no "crombolo" field, so it is not a bundle']
+  const f = field as Record<string, unknown>
+
+  if (typeof f.id !== 'string' || !BUNDLE_ID.test(f.id))
+    problems.push(
+      `"crombolo.id" must be 2–39 lowercase letters, digits and hyphens starting with a letter${
+        typeof f.id === 'string' ? `, not "${f.id}"` : ''
+      }`,
+    )
+  if (f.name !== undefined && (typeof f.name !== 'string' || f.name.trim() === ''))
+    problems.push('"crombolo.name" must be a non-empty string')
+  if (typeof json.name !== 'string' || json.name === '')
+    problems.push('its package.json has no "name"')
+  if (typeof json.version !== 'string' || json.version === '')
+    problems.push('its package.json has no "version"')
+
+  if (f.extensions !== undefined && !Array.isArray(f.extensions))
+    problems.push('"crombolo.extensions" must be a list of extension manifests')
+  if (f.migrations !== undefined && f.migrations !== 'compatible' && f.migrations !== 'breaking')
+    problems.push('"crombolo.migrations" is "compatible" or "breaking"')
+  if (f.server !== undefined && (typeof f.server !== 'string' || !EXPORT_NAME.test(f.server)))
+    problems.push('"crombolo.server" must name the factory the package exports')
+  if (f.content !== undefined) {
+    if (typeof f.content !== 'string') problems.push('"crombolo.content" must be a directory')
+    else if (directory) {
+      const target = insidePackage(directory, f.content)
+      if (!target) problems.push(`"crombolo.content" (${f.content}) is outside the package`)
+      else if (!existsSync(join(target, PAYLOAD_MANIFEST)))
+        problems.push(`"crombolo.content" (${f.content}) holds no ${PAYLOAD_MANIFEST}`)
+    } else if (isAbsolute(f.content) || f.content.split(/[\\/]/).includes('..'))
+      problems.push(`"crombolo.content" (${f.content}) is outside the package`)
+  }
+
+  const hasExtensions = Array.isArray(f.extensions) && f.extensions.length > 0
+  if (!hasExtensions && f.content === undefined && f.server === undefined)
+    problems.push(
+      'it declares no "extensions", "content" or "server", so it is a bundle that does nothing',
+    )
+
+  const peer = json.peerDependencies?.[CORE_PACKAGE]
+  if (typeof peer !== 'string' || peer.trim() === '')
+    problems.push(`its package.json declares no peerDependencies["${CORE_PACKAGE}"]`)
+  return problems
+}
+
+/**
+ * The package at a directory, read as a bundle.
+ *
+ * `undefined` with no problems means the package is not a bundle at all — an
+ * ordinary dependency. Problems mean it claims to be one and is malformed.
+ */
+export function readBundlePackage(directory: string): {
+  bundle: BundlePackage | undefined
+  problems: string[]
+} {
+  const json = readPackageJson(join(directory, 'package.json'))
+  if (!declaresBundle(json)) return { bundle: undefined, problems: [] }
+  const problems = validateBundlePackage(json as PackageJson, directory)
+  if (problems.length > 0) return { bundle: undefined, problems }
+  const pkg = json as Required<Pick<PackageJson, 'name' | 'version'>> & PackageJson
+  const field = pkg.crombolo as CromboloField
+  return {
+    bundle: {
+      packageName: pkg.name,
+      version: pkg.version,
+      directory,
+      id: field.id,
+      name: field.name ?? pkg.name,
+      peerRange: pkg.peerDependencies?.[CORE_PACKAGE] as string,
+      private: pkg.private === true,
+      field,
+      contentDir: field.content ? insidePackage(directory, field.content) : undefined,
+      carries: {
+        extensions: Array.isArray(field.extensions) && field.extensions.length > 0,
+        content: field.content !== undefined,
+        server: field.server !== undefined,
+      },
+    },
+    problems: [],
+  }
+}
+
+const COMPARATOR = /^(?:[~^]|[<>]=?|=)?v?(?:\d+|[xX*])(?:\.(?:\d+|[xX*])){0,2}(?:-[0-9A-Za-z.-]+)?$/
+
+/** A semver range, token by token: Bun's own matcher accepts nonsense and matches it. */
+export function isSemverRange(range: string): boolean {
+  const tokens = range.trim().split(/\s+/)
+  return tokens.length > 0 && tokens.every((t) => t === '||' || t === '-' || COMPARATOR.test(t))
+}
+
+/** Whether a bundle's peer range admits a core version; a reason when it does not. */
+export function peerRangeProblem(bundle: BundlePackage, coreVersion: string): string | undefined {
+  // A workspace link is resolved to this very tree, so it is this version by construction.
+  if (bundle.peerRange.startsWith('workspace:')) return undefined
+  const satisfied =
+    isSemverRange(bundle.peerRange) && Bun.semver.satisfies(coreVersion, bundle.peerRange)
+  return satisfied
+    ? undefined
+    : `${bundle.packageName} (${bundle.id}) is written for ${CORE_PACKAGE} ${bundle.peerRange}, and this site runs ${coreVersion}`
+}
+
+/**
+ * The directory a dependency resolves to, walking up as Node does, so a
+ * workspace root's hoisted `node_modules` is found from a site inside it.
+ */
+export function resolvePackageDir(from: string, name: string): string | undefined {
+  // A name may not climb out of node_modules, whatever a package.json says.
+  if (name.includes('..') || name.startsWith('/') || name.startsWith('.')) return undefined
+  let dir = normalize(from)
+  for (;;) {
+    const candidate = join(dir, 'node_modules', name)
+    if (existsSync(join(candidate, 'package.json'))) return candidate
+    const parent = dirname(dir)
+    if (parent === dir) return undefined
+    dir = parent
+  }
+}
+
+export interface DiscoveredBundles {
+  bundles: BundlePackage[]
+  /** A declared dependency that claims to be a bundle and is not a valid one. */
+  problems: { packageName: string; problems: string[] }[]
+}
+
+/**
+ * Every declared dependency of the site that is a bundle.
+ *
+ * Only declared dependencies are read, never a walk of `node_modules`, so a
+ * transitive dependency cannot claim to be a bundle the site never asked for.
+ */
+export function discoverBundles(siteDir: string): DiscoveredBundles {
+  const json = readPackageJson(join(siteDir, 'package.json'))
+  const found: DiscoveredBundles = { bundles: [], problems: [] }
+  if (!json?.dependencies) return found
+  for (const name of Object.keys(json.dependencies).sort()) {
+    const directory = resolvePackageDir(siteDir, name)
+    if (!directory) continue
+    const read = readBundlePackage(directory)
+    if (read.bundle) found.bundles.push(read.bundle)
+    else if (read.problems.length > 0)
+      found.problems.push({ packageName: name, problems: read.problems })
+  }
+  return found
+}
+
+/** Whether a path is a directory, for telling a package path from a package name. */
+export function isDirectory(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}

package/src/extensions.ts

@@ -1,5 +1,5 @@
 /**
- * Backoffice extensions as npm dependencies. `docs/17-bundles.md`.
+ * Backoffice extensions as npm dependencies. `docs/bundles.md`.
  *
  * A site's extensions are its dependencies: discovery reads the site's own
  * `package.json`, resolves each dependency through `node_modules`, and takes the
@@ -10,8 +10,13 @@
  * transitive dependency cannot put an extension into a backoffice that never
  * asked for it.
  */
-import { existsSync, readFileSync } from 'node:fs'
-import { dirname, join, normalize, sep } from 'node:path'
+import { join, normalize, sep } from 'node:path'
+import {
+  type BundlePackage,
+  type DiscoveredBundles,
+  discoverBundles,
+  readBundlePackage,
+} from './bundle-package.ts'
 import type { PackageManifest, PackageManifestImportmap } from './manifests.ts'
 
 /** Where an installed bundle's assets are served from. */
@@ -20,26 +25,14 @@ export const EXTENSION_PATH = '/bundles'
 /** The npm keyword a bundle publishes so the marketplace can find it. */
 export const EXTENSION_KEYWORD = 'crombolo-bundle'
 
-/**
- * What a dependency declares to become a backoffice extension. The shape is
- * Umbraco's manifest minus the parts the server owns — the name and version
- * come from the package itself.
- */
-export interface CromboloField {
-  id?: string
-  name?: string
-  allowPublicAccess?: boolean
-  allowTelemetry?: boolean
-  extensions?: unknown[]
-  importmap?: PackageManifestImportmap
-}
-
+/** A bundle's backoffice half, as the manifest endpoint serves it. */
 export interface InstalledExtension {
   /** The npm package name, which is also its segment in the asset path. */
   packageName: string
   version: string
   directory: string
   manifest: PackageManifest
+  bundle: BundlePackage
 }
 
 /**
@@ -48,39 +41,6 @@ export interface InstalledExtension {
  */
 const ASSET_KEYS = new Set(['element', 'api', 'js', 'loader'])
 
-interface PackageJson {
-  name?: string
-  version?: string
-  dependencies?: Record<string, string>
-  crombolo?: CromboloField
-}
-
-function readJson(file: string): PackageJson | undefined {
-  try {
-    const parsed = JSON.parse(readFileSync(file, 'utf8')) as unknown
-    return parsed && typeof parsed === 'object' ? (parsed as PackageJson) : undefined
-  } catch {
-    return undefined
-  }
-}
-
-/**
- * The directory a dependency resolves to, walking up as Node does, so a
- * workspace root's hoisted `node_modules` is found from a site inside it.
- */
-export function resolvePackageDir(from: string, name: string): string | undefined {
-  // A name may not climb out of node_modules, whatever a package.json says.
-  if (name.includes('..') || name.startsWith('/') || name.startsWith('.')) return undefined
-  let dir = normalize(from)
-  for (;;) {
-    const candidate = join(dir, 'node_modules', name)
-    if (existsSync(join(candidate, 'package.json'))) return candidate
-    const parent = dirname(dir)
-    if (parent === dir) return undefined
-    dir = parent
-  }
-}
-
 /** `dist/seo.js` inside `@acme/seo` becomes `/bundles/@acme/seo/dist/seo.js`. */
 const assetPath = (packageName: string, target: string): string =>
   target.startsWith('/') || /^[a-z][a-z0-9+.-]*:/i.test(target)
@@ -118,42 +78,39 @@ function rewriteImportmap(
   return Object.keys(scopes).length > 0 ? { imports, scopes } : { imports }
 }
 
-/** One dependency's manifest, or undefined when it declares no extensions. */
-export function readExtension(
-  directory: string,
-  packageName: string,
-): InstalledExtension | undefined {
-  const json = readJson(join(directory, 'package.json'))
-  const field = json?.crombolo
-  if (!field || !Array.isArray(field.extensions) || field.extensions.length === 0) return undefined
+/** A bundle's backoffice half, or undefined when it declares no extensions. */
+export function extensionOf(bundle: BundlePackage): InstalledExtension | undefined {
+  const field = bundle.field
+  if (!bundle.carries.extensions) return undefined
+  const packageName = bundle.packageName
   return {
     packageName,
-    version: json?.version ?? '0.0.0',
-    directory,
+    version: bundle.version,
+    directory: bundle.directory,
+    bundle,
     manifest: {
-      name: field.name ?? packageName,
-      id: field.id ?? packageName,
-      version: json?.version ?? '0.0.0',
+      name: bundle.name,
+      id: bundle.id,
+      version: bundle.version,
       allowPublicAccess: field.allowPublicAccess ?? false,
       allowTelemetry: field.allowTelemetry ?? false,
-      extensions: field.extensions.map((extension) => rewriteAssets(extension, packageName)),
+      extensions: (field.extensions ?? []).map((extension) =>
+        rewriteAssets(extension, packageName),
+      ),
       importmap: rewriteImportmap(field.importmap, packageName),
     },
   }
 }
 
-/** Every declared dependency of the site that is a backoffice extension. */
+/** One dependency's backoffice half, or undefined when it is no bundle or declares no extensions. */
+export function readExtension(directory: string): InstalledExtension | undefined {
+  const { bundle } = readBundlePackage(directory)
+  return bundle ? extensionOf(bundle) : undefined
+}
+
+/** Every declared dependency of the site that is a bundle with a backoffice half. */
 export function discoverExtensions(siteDir: string): InstalledExtension[] {
-  const json = readJson(join(siteDir, 'package.json'))
-  if (!json?.dependencies) return []
-  const found: InstalledExtension[] = []
-  for (const name of Object.keys(json.dependencies).sort()) {
-    const directory = resolvePackageDir(siteDir, name)
-    if (!directory) continue
-    const extension = readExtension(directory, name)
-    if (extension) found.push(extension)
-  }
-  return found
+  return discoverBundles(siteDir).bundles.flatMap((bundle) => extensionOf(bundle) ?? [])
 }
 
 /**
@@ -197,6 +154,8 @@ export function resolveExtensionFile(
 
 export interface ExtensionRegistry {
   list(): readonly InstalledExtension[]
+  /** Every bundle the site depends on, whatever it carries, and the ones that are malformed. */
+  bundles(): DiscoveredBundles
   /** Called after an install or an uninstall, so the next read sees it. */
   invalidate(): void
 }
@@ -213,14 +172,16 @@ export function createExtensionRegistry(
   siteDir: string,
   options: { cache?: boolean } = {},
 ): ExtensionRegistry {
-  let cached: InstalledExtension[] | undefined
+  let cached: DiscoveredBundles | undefined
   const cache = options.cache ?? true
+  const discovered = () => {
+    if (!cache) return discoverBundles(siteDir)
+    cached ??= discoverBundles(siteDir)
+    return cached
+  }
   return {
-    list() {
-      if (!cache) return discoverExtensions(siteDir)
-      cached ??= discoverExtensions(siteDir)
-      return cached
-    },
+    list: () => discovered().bundles.flatMap((bundle) => extensionOf(bundle) ?? []),
+    bundles: discovered,
     invalidate() {
       cached = undefined
     },