@crombolo/server 0.13.2 → 0.14.1

package/src/bundle-install.ts

@@ -12,7 +12,7 @@
  * with the connection it already has: the CLI's `content check` and
  * `content import` open a database and call these.
  */
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import {
   type BundlePackage,
@@ -27,7 +27,9 @@ import { ObjectTypes } from '@crombolo/core'
 import {
   answersByNode,
   type Db,
+  DictionaryRepository,
   describeRefFailure,
+  Locks,
   type NodeRow,
   recordInLedger,
   resolveNodeRef,
@@ -35,9 +37,11 @@ import {
   writeReport,
 } from '@crombolo/data'
 import {
+  BUNDLE_SECTIONS,
   type CheckOptions,
   type ContentSet,
   checkBundle,
+  type ImportResult,
   importBundle,
   isPackageName,
   loadBundle,
@@ -54,22 +58,40 @@ import {
 } from '@crombolo/transfer'
 import { type BackupResult, backupBefore } from './backup.ts'
 import {
-  applySections,
   type CarriedSections,
   carriedSections,
   carriesSections,
+  keepDictionary,
+  keptDictionary,
   planSections,
-  promoteBackups,
+  promoteStaged,
+  type RestoredFiles,
   replacementsNeedingPermission,
+  restoreSectionFiles,
   type SectionFile,
   type SectionOptions,
   type SectionPlan,
   type SectionResult,
   stageBackups,
+  stagedConfig,
+  stageSections,
+  swappedSections,
+  swapSections,
 } from './bundle-sections.ts'
 import { type CromboloConfig, VERSION } from './config.ts'
+import { dictionaryToUdt, importDictionaryUdt, writeDictionaryUdt } from './dictionary-transfer.ts'
+import { syncDomainsFile } from './domains.ts'
 import { mediaStoreFor, placeBlobs } from './media-files.ts'
-import { componentAliasesIn } from './schema.ts'
+import { componentAliasesIn, syncSchemaDirectory } from './schema.ts'
+import { publishSchema } from './schema-store.ts'
+import {
+  carriesAdministrator,
+  prunePeople,
+  pruneSite,
+  type ReplaceMode,
+  recordPruned,
+  requiresProblems,
+} from './site-replace.ts'
 
 /** The trees a content selector or placement may name. */
 export const CONTENT_OBJECT_TYPES = [ObjectTypes.Document, ObjectTypes.Media, ObjectTypes.Element]
@@ -364,6 +386,12 @@ export async function checkBundleContent(
 }
 
 export interface ContentImportInput extends TransferInput {
+  /**
+   * Make the site the file's (story 105). `replace` recycles content and media
+   * the file lacks and keeps the site's people; `replace-all` deletes them, and
+   * the people the file lacks.
+   */
+  replace?: ReplaceMode
   publish?: boolean
   label?: string
   /** Postgres: the caller has taken a backup itself. */
@@ -438,7 +466,28 @@ export async function pendingResolutionsFile(
   })
 }
 
-/** Back up, re-check, then apply in one transaction and record the run. */
+/** Thrown inside the import's transaction to roll everything back, carrying why. */
+class InstallRefused extends Error {
+  constructor(
+    readonly problems: string[],
+    readonly result?: ImportResult,
+  ) {
+    super(problems[0] ?? 'the import was refused')
+  }
+}
+
+/**
+ * Back up, re-check, then apply all or nothing and record the run (story 105).
+ *
+ * Three phases. **Stage**: every carried section is written into a copy under
+ * the run's directory, and the media files are placed under their own keys.
+ * **One transaction**: the prune a replace asks for, the schema sync against
+ * the staged copy, the dictionary and the content — so a refusal anywhere
+ * leaves the database as it was. **Swap**: once it commits, the staged folders
+ * move into place and what they replace is kept for the run's revert. A
+ * failure before the swap leaves the site's files untouched and removes the
+ * media files it placed.
+ */
 export async function installBundleContent(
   db: Db,
   config: CromboloConfig,
@@ -452,31 +501,13 @@ export async function installBundleContent(
     throw new PassphraseError(
       'This bundle is encrypted: give the passphrase it was exported with. Nothing was written.',
     )
-  // The coarse layer, under the fine-grained revert: in-place conversion is not
-  // reversible by itself, so the same rule as `upgrade` applies here.
-  const backup = await backupBefore(config, {
-    reason: 'content-import',
-    backupTaken: input.backupTaken,
-  })
-  const prepared = await transferOptions(db, config, bundle, input)
-  const started = performance.now()
-
-  /**
-   * Structure first, but planned before anything is written.
-   *
-   * The order is forced: content naming a type this bundle brings cannot pass
-   * a check until that type exists, so the schema has to land before the
-   * content is checked. Which means a blocking schema change has to be caught
-   * *before* the first file is written — otherwise a refused install leaves a
-   * half-applied site behind. `planSections` answers that from an overlay
-   * copy, so the site is untouched until it is known the schema can apply.
-   */
-  const plan = carriesSections(carried) ? await planSections(db, config, carried, input) : undefined
-  const refuse = (problems: string[]): ContentImportResult => ({
+  const manifest = set.manifest
+  const replace = input.replace
+  const refuse = (problems: string[], backup?: BackupResult): ContentImportResult => ({
     bundle: summarise(bundle),
-    backup,
+    backup: backup ?? { kind: 'none' },
     runId: undefined,
-    check: emptyCheck(set.manifest.id),
+    check: emptyCheck(manifest.id),
     blobs: null,
     published: 0,
     publishFailures: [],
@@ -484,69 +515,222 @@ export async function installBundleContent(
     sections: undefined,
   })
 
-  if (plan?.schema?.classification === 'breaking')
+  // What has to be true before anything is backed up or written.
+  if (replace && manifest.scope !== 'site')
+    return refuse(['only a whole-site file (crombolo export --site) can replace a site'])
+  const missing = requiresProblems(manifest, config.siteDir)
+  if (missing.length > 0) return refuse(missing)
+  if (manifest.media === 'omitted' && !input.allowMissingBlobs)
     return refuse([
-      'the schema this bundle carries cannot be applied here without data work',
-      ...plan.schema.findings,
+      'this file was written without its media files (--no-media); pass --allow-missing-media to import the media items without them',
     ])
+  if (replace === 'replace-all' && !carriesAdministrator(set.people))
+    return refuse([
+      'this file carries no back-office administrator, so replacing everything would leave nobody able to sign in; export it with --with-users, or use --replace',
+    ])
+
+  // A replace takes the file's side of every difference, and replaces files.
+  const effective: ContentImportInput = replace
+    ? { ...input, resolveAll: 'take-bundle', replaceFiles: true, publish: input.publish ?? true }
+    : input
+
+  // The coarse layer, under the fine-grained revert: in-place conversion is not
+  // reversible by itself, so the same rule as `upgrade` applies here.
+  const backup = await backupBefore(config, {
+    reason: 'content-import',
+    backupTaken: input.backupTaken,
+  })
+  const prepared = await transferOptions(db, config, bundle, effective)
+  const started = performance.now()
 
   /**
-   * A file this site already has is not replaced without being asked.
-   *
-   * Every section is editable in the backoffice — a stylesheet, a template, a
-   * content type — so an overwrite destroys somebody's work, and the site
-   * may have no git to recover it from. Refused by name, like any other
-   * finding a person has to answer.
+   * Structure first, but planned before anything is written: a blocking
+   * schema change is caught from an overlay copy, and a file an editor may
+   * have changed is not replaced without being asked.
    */
-  const needingPermission = plan ? replacementsNeedingPermission(plan, input) : []
+  const plan = carriesSections(carried)
+    ? await planSections(db, config, carried, effective)
+    : undefined
+  if (plan?.schema?.classification === 'breaking')
+    return refuse(
+      [
+        'the schema this bundle carries cannot be applied here without data work',
+        ...plan.schema.findings,
+      ],
+      backup,
+    )
+  const needingPermission = plan ? replacementsNeedingPermission(plan, effective) : []
   if (needingPermission.length > 0)
-    return refuse([
-      `${needingPermission.length} file(s) here would be replaced; pass --replace-files to allow it`,
-      ...needingPermission.map((file: SectionFile) => file.path),
-    ])
+    return refuse(
+      [
+        `${needingPermission.length} file(s) here would be replaced; pass --replace-files to allow it`,
+        ...needingPermission.map((file: SectionFile) => file.path),
+      ],
+      backup,
+    )
 
-  // Staged whenever something *will* be replaced — which is decided by the
-  // plan, not by the permission check: by this point permission has been
-  // given, so the files needing it are exactly the ones to back up.
-  const willReplace = (plan?.files ?? []).some((file) => file.action === 'overwrite')
-  const staging = plan && willReplace ? stageBackups(config) : undefined
-  const sections = plan
-    ? await applySections(db, config, carried, { ...input, backupDir: staging })
-    : undefined
-  const result = await importBundle(db, set, {
-    ...prepared.options,
-    publish: input.publish ?? false,
-    nodeId: config.nodeId,
-    label: input.label,
-    package: { name: bundle.package.packageName, version: bundle.package.version },
+  // ---- 1. Stage
+  const runDir = stageBackups(config)
+  const staged =
+    plan || replace
+      ? stageSections(config, carried, { ...effective, replace: Boolean(replace) }, runDir)
+      : undefined
+  const store = blobs.size > 0 ? await mediaStoreFor(config) : undefined
+  const placedHere: string[] = []
+  let placed: ContentImportResult['blobs'] = null
+  if (store) {
+    for (const key of blobs.keys()) if (!(await store.get(key))) placedHere.push(key)
+    placed = await placeBlobs(store, blobs, bundle.openBlob)
+  }
+  const undoStage = async () => {
+    for (const key of placedHere) await store?.delete(key).catch(() => {})
+    rmSync(runDir, { recursive: true, force: true })
+  }
+
+  // ---- 2. One transaction
+  let schemaAction: string | undefined
+  let dictionary: SectionResult['dictionary']
+  let result: ImportResult
+  try {
+    result = await db.locks.withLock(Locks.Schema, () =>
+      db.locks.withLock(Locks.ContentTree, () =>
+        db.transaction(async (tx) => {
+          const pruned = replace ? await pruneSite(tx, set, replace, config.nodeId) : []
+          if (replace === 'replace-all') await prunePeople(tx, set.people)
+          if (staged?.next.schema) {
+            const report = await syncSchemaDirectory(
+              tx,
+              stagedConfig(config, staged),
+              { nodeId: config.nodeId, revision: config.schemaRevision },
+              { forceRetireTypes: Boolean(replace) },
+            )
+            if (report.action === 'refused' || report.action === 'skipped-older')
+              throw new InstallRefused([
+                `the schema this bundle carries was not applied: ${report.reason ?? report.action}`,
+              ])
+            schemaAction = report.action
+          }
+          const udtPath = `${BUNDLE_SECTIONS.dictionary}.udt`
+          const carriesDictionary = (carried.carries.dictionary ?? []).includes(udtPath)
+          if (carriesDictionary || replace) {
+            const repo = new DictionaryRepository(tx)
+            keepDictionary(runDir, writeDictionaryUdt(await dictionaryToUdt(repo)))
+            if (replace) for (const root of await repo.children(null)) await repo.delete(root.key)
+            for (const path of carried.carries.dictionary ?? []) {
+              const file = carried.files.get(path)
+              if (!file) continue
+              const outcome = await importDictionaryUdt(tx, readFileSync(file, 'utf8'))
+              dictionary = {
+                imported: (dictionary?.imported ?? 0) + outcome.imported,
+                skipped: [...(dictionary?.skipped ?? []), ...outcome.skipped],
+              }
+            }
+          }
+          const imported = await importBundle(tx, set, {
+            ...prepared.options,
+            publish: effective.publish ?? false,
+            nodeId: config.nodeId,
+            label: input.label,
+            package: { name: bundle.package.packageName, version: bundle.package.version },
+            exact: Boolean(replace),
+          })
+          if (!imported.runId) throw new InstallRefused([], imported)
+          await recordPruned(tx, imported.runId, pruned)
+          return imported
+        }),
+      ),
+    )
+  } catch (error) {
+    await undoStage()
+    if (!(error instanceof InstallRefused)) throw error
+    if (!error.result) return refuse(error.problems, backup)
+    await writeReport(db, error.result.check.findings, { source: 'transfer', scope: manifest.id })
+    await recordPending(db, bundle, input, prepared.options.allowMissingBlobs ?? false)
+    return {
+      ...refuse(prepared.problems, backup),
+      check: error.result.check,
+    }
+  }
+  const runId = result.runId as string
+
+  // ---- 3. Swap
+  if (staged) {
+    swapSections(config, staged)
+    if (staged.next.schema && config.schemaStore)
+      await publishSchema(config.schemaStore, config.schemaDir)
+  }
+  const kept = promoteStaged(config, runDir, runId)
+  // Domains belong to where the site runs, never to the file: rebound by the
+  // site's own `domains.toml` onto the pages now in its tree.
+  if (replace) await syncDomainsFile(db, config.siteDir)
+  await writeReport(db, result.check.findings, { source: 'transfer', scope: manifest.id })
+  await new TransferAnswerRepository(db).clear(manifest.id)
+  await recordInLedger(db, {
+    name: `content import ${manifest.id}`,
+    kind: 'transfer',
+    durationMs: Math.round(performance.now() - started),
+    appliedBy: config.nodeId,
+    note: `run ${runId}, ${bundle.package.packageName}@${bundle.package.version}${replace ? `, --${replace}` : ''}`,
   })
-  await writeReport(db, result.check.findings, { source: 'transfer', scope: set.manifest.id })
-  const outcome: ContentImportResult = {
+  return {
     bundle: summarise(bundle),
     backup,
-    runId: result.runId,
+    runId,
     check: result.check,
-    blobs: null,
+    blobs: placed,
     published: result.published.length,
     publishFailures: result.publishFailures,
     problems: prepared.problems,
-    sections,
+    sections: staged
+      ? {
+          written: staged.written,
+          replaced: [],
+          schema: schemaAction ? { action: schemaAction } : undefined,
+          dictionary,
+        }
+      : undefined,
+    replacedFilesKept: staged ? kept : undefined,
   }
-  if (!result.runId) {
-    await recordPending(db, bundle, input, prepared.options.allowMissingBlobs ?? false)
-    return outcome
+}
+
+export interface RevertedSections extends RestoredFiles {
+  /** The schema sync after the swap back, when the run swapped schema in. */
+  schema: string | undefined
+  /** Whether the dictionary was put back as the run found it. */
+  dictionary: boolean
+}
+
+/**
+ * What an install did beyond its content, undone once `revertRun` has put the
+ * content back (story 105): the folders swapped back, the schema re-synced to
+ * them, and the dictionary restored as the run found it.
+ */
+export async function revertSections(
+  db: Db,
+  config: CromboloConfig,
+  runId: string,
+): Promise<RevertedSections> {
+  const swapped = swappedSections(config, runId)
+  const files = restoreSectionFiles(config, runId)
+  let schema: string | undefined
+  if (swapped.includes('schema')) {
+    // A type the install brought has content only in the bin by now, which is
+    // what retiring it here is for.
+    const report = await syncSchemaDirectory(
+      db,
+      config,
+      { nodeId: config.nodeId, revision: config.schemaRevision },
+      { forceRetireTypes: true },
+    )
+    schema = report.action
+    if (config.schemaStore) await publishSchema(config.schemaStore, config.schemaDir)
   }
-  await new TransferAnswerRepository(db).clear(set.manifest.id)
-  // The backups become the run's, so `content revert` can find them.
-  if (staging) outcome.replacedFilesKept = promoteBackups(config, staging, result.runId)
-  if (blobs.size > 0)
-    outcome.blobs = await placeBlobs(await mediaStoreFor(config), blobs, bundle.openBlob)
-  await recordInLedger(db, {
-    name: `content import ${set.manifest.id}`,
-    kind: 'transfer',
-    durationMs: Math.round(performance.now() - started),
-    appliedBy: config.nodeId,
-    note: `run ${result.runId}, ${bundle.package.packageName}@${bundle.package.version}`,
-  })
-  return outcome
+  const kept = keptDictionary(config, runId)
+  if (kept !== undefined)
+    await db.transaction(async (tx) => {
+      const repo = new DictionaryRepository(tx)
+      for (const root of await repo.children(null)) await repo.delete(root.key)
+      await importDictionaryUdt(tx, kept)
+    })
+  return { ...files, schema, dictionary: kept !== undefined }
 }

package/src/bundle-sections.ts

@@ -20,6 +20,7 @@ import {
   existsSync,
   mkdirSync,
   mkdtempSync,
+  readdirSync,
   readFileSync,
   renameSync,
   rmSync,
@@ -33,6 +34,7 @@ import { BUNDLE_SECTIONS } from '@crombolo/transfer'
 import type { CromboloConfig } from './config.ts'
 import { importDictionaryUdt } from './dictionary-transfer.ts'
 import { checkSchemaDirectory, syncSchemaDirectory } from './schema.ts'
+import { publishSchema } from './schema-store.ts'
 
 /** What applying one carried file would do to the destination. */
 export type FileAction = 'create' | 'overwrite' | 'unchanged'
@@ -277,6 +279,10 @@ export async function applySections(
       revision: config.schemaRevision,
     })
     schema = { action: report.action }
+    // The store is the truth where there is one, as for a backoffice edit: the
+    // next boot materialises it over this directory (story 106).
+    if (config.schemaStore && (report.action === 'applied' || report.action === 'skipped-same'))
+      await publishSchema(config.schemaStore, config.schemaDir)
   }
 
   if (!options.withoutFiles) {
@@ -377,6 +383,23 @@ export interface RestoredFiles {
  */
 export function restoreSectionFiles(config: CromboloConfig, runId: string): RestoredFiles {
   const dir = join(config.siteDir, RUN_BACKUP_DIR, runId)
+  // A staged install swapped whole sections in; reverting swaps them back, and
+  // keeps what it takes out beside them so the revert can itself be reverted.
+  const swapped = swappedSections(config, runId)
+  if (swapped.length > 0) {
+    const restored: string[] = []
+    for (const section of swapped) {
+      const destination = destinationOf(config, section)
+      if (!destination) continue
+      const previous = join(dir, PREVIOUS_DIR, section)
+      const reverted = join(dir, 'reverted', section)
+      rmSync(reverted, { recursive: true, force: true })
+      moveContents(destination, reverted)
+      moveContents(previous, destination)
+      restored.push(destination)
+    }
+    return { restored, removed: [] }
+  }
   const record = join(dir, RECORD_FILE)
   if (!existsSync(record)) return { restored: [], removed: [] }
 
@@ -422,3 +445,140 @@ function sectionFor(path: string): BundleSection | undefined {
     if (top === dir) return section as BundleSection
   return undefined
 }
+
+/** Which sections an install staged, and where each one's current files went. */
+interface SwapRecord {
+  sections: BundleSection[]
+}
+
+const SWAP_FILE = 'swap.json'
+const NEXT_DIR = 'next'
+const PREVIOUS_DIR = 'previous'
+const DICTIONARY_BEFORE = 'dictionary-before.udt'
+
+export interface StagedSections {
+  /** The run's directory: staged files, then the swapped-out originals. */
+  dir: string
+  /** Each staged section's directory under `dir`. */
+  next: Partial<Record<BundleSection, string>>
+  /** The files the bundle brought, by where they will land. */
+  written: string[]
+}
+
+/**
+ * Moves what a directory holds, not the directory: a site's folders can be
+ * mount points, which cannot be renamed. A move across file systems copies.
+ */
+function moveContents(from: string, to: string): void {
+  if (!existsSync(from)) return
+  mkdirSync(to, { recursive: true })
+  for (const entry of readdirSync(from)) {
+    const source = join(from, entry)
+    const target = join(to, entry)
+    rmSync(target, { recursive: true, force: true })
+    try {
+      renameSync(source, target)
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EXDEV') throw error
+      cpSync(source, target, { recursive: true })
+      rmSync(source, { recursive: true, force: true })
+    }
+  }
+}
+
+/**
+ * Stage, the first of an install's three phases (story 105): every carried
+ * section written into a copy under the run's directory, the site untouched.
+ *
+ * Overlaid, a staged section is the site's directory with the bundle's files
+ * laid over it, and only a section the bundle carries is staged. Replacing, a
+ * staged section is the bundle's files alone, and every section is staged — so
+ * what the file does not have is gone once the copies swap in.
+ */
+export function stageSections(
+  config: CromboloConfig,
+  carried: CarriedSections,
+  options: SectionOptions & { replace?: boolean },
+  dir: string,
+): StagedSections {
+  const staged: StagedSections = { dir, next: {}, written: [] }
+  for (const section of ['schema', ...FILE_SECTIONS] as BundleSection[]) {
+    if (section === 'schema' ? options.withoutSchema : options.withoutFiles) continue
+    const destination = destinationOf(config, section)
+    if (!destination) continue
+    const paths = carried.carries[section] ?? []
+    if (!options.replace && paths.length === 0) continue
+    const next = join(dir, NEXT_DIR, section)
+    mkdirSync(next, { recursive: true })
+    if (!options.replace && existsSync(destination)) cpSync(destination, next, { recursive: true })
+    for (const path of paths) {
+      const inside = withinSection(path, section)
+      const target = join(next, inside)
+      mkdirSync(dirname(target), { recursive: true })
+      writeFileSync(target, read(carried, path))
+      staged.written.push(join(destination, inside))
+    }
+    staged.next[section] = next
+  }
+  return staged
+}
+
+/** A config whose section directories are the staged copies, for the sync inside the transaction. */
+export function stagedConfig(config: CromboloConfig, staged: StagedSections): CromboloConfig {
+  return {
+    ...config,
+    schemaDir: staged.next.schema ?? config.schemaDir,
+    componentsDir: staged.next.components ?? config.componentsDir,
+    stylesheetsDir: staged.next.styles ?? config.stylesheetsDir,
+    scriptsDir: staged.next.scripts ?? config.scriptsDir,
+  }
+}
+
+/**
+ * Swap, the third phase, once the transaction has committed: each staged
+ * section moves into place and what it replaces is kept under the run, for its
+ * revert.
+ */
+export function swapSections(config: CromboloConfig, staged: StagedSections): void {
+  const sections = Object.keys(staged.next) as BundleSection[]
+  for (const section of sections) {
+    const destination = destinationOf(config, section) as string
+    moveContents(destination, join(staged.dir, PREVIOUS_DIR, section))
+    moveContents(staged.next[section] as string, destination)
+  }
+  rmSync(join(staged.dir, NEXT_DIR), { recursive: true, force: true })
+  const record: SwapRecord = { sections }
+  writeFileSync(join(staged.dir, SWAP_FILE), `${JSON.stringify(record, null, 2)}\n`)
+}
+
+/** Keeps the dictionary as it was, for a revert to put back. */
+export function keepDictionary(dir: string, udt: string): void {
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(dir, DICTIONARY_BEFORE), udt)
+}
+
+/** The dictionary a run kept, when it kept one. */
+export function keptDictionary(config: CromboloConfig, runId: string): string | undefined {
+  const file = join(config.siteDir, RUN_BACKUP_DIR, runId, DICTIONARY_BEFORE)
+  return existsSync(file) ? readFileSync(file, 'utf8') : undefined
+}
+
+/** Whether a run swapped whole sections, so that reverting it swaps them back. */
+export function swappedSections(config: CromboloConfig, runId: string): BundleSection[] {
+  const file = join(config.siteDir, RUN_BACKUP_DIR, runId, SWAP_FILE)
+  if (!existsSync(file)) return []
+  try {
+    return (JSON.parse(readFileSync(file, 'utf8')) as SwapRecord).sections
+  } catch {
+    return []
+  }
+}
+
+/** Moves a staging directory to be the run's, once the run exists. */
+export function promoteStaged(config: CromboloConfig, dir: string, runId: string): string {
+  const target = join(config.siteDir, RUN_BACKUP_DIR, runId)
+  rmSync(target, { recursive: true, force: true })
+  mkdirSync(dirname(target), { recursive: true })
+  renameSync(dir, target)
+  return target
+}

package/src/bundles.ts

@@ -62,6 +62,7 @@ import {
 } from '@crombolo/data'
 import { normaliseRedirectPath, type PublishedCache } from '@crombolo/render'
 import type { BundleForms } from './form-types.ts'
+import type { BundleIdentityProviders } from './identity-provider-overrides.ts'
 import type { BundleEvents } from './webhooks.ts'
 
 /** The segment every bundle's routes hang below, inside the plugin API. */
@@ -142,6 +143,8 @@ export interface BundleHost {
   redirects: BundleRedirects
   documents: BundleDocuments
   log: BundleLog
+  /** The identity providers the config declares, and an administrator's overrides of their settings (story 033). */
+  identityProviders: BundleIdentityProviders
   /** The bundle's own tables, and only for a bundle that declares some. */
   tables: BundleTablesCapability
 }
@@ -182,6 +185,7 @@ export const BUNDLE_CAPABILITIES: readonly BundleCapability[] = [
   'documents',
   'log',
   'tables',
+  'identityProviders',
 ]
 
 /** What a handler is handed: the declared capabilities, with `tables` typed from the declaration. */