Components and Component packages

Keep two states apart

• The implemented lane. Drop-folder install, the Project-scoped exact Component catalog query and its authenticated read relay, the presentation resolution port and Python worker execution are implemented and are named path by path as RFC-014's partial-foundation implementation evidence. An admitted Component projects through the host-owned component.declarative@2 body, and an unresolved target falls back to the read-only unsupported diagnostic. Storage, catalog, detail and execution reads enforce exact Workspace/Project data-path isolation.
• Public third-party admission stays contract_only and fail closed. RFC-014 keeps productAvailability: contract_only and every activation flag false. Those reads do not bind the requested scope to the authenticated principal, execution trust is not closed, and the installer has no real inactive quarantine state, so public marketplace publisher admission and package executable UI stay refused. Settings are declared through component-declared-settings@1, at most eight per declaration, and the host draws each control from its own registry. RFC-016's component-rich-surface-declaration@1 is the separate RFC-014 successor for isolated rich surfaces; its implementation does not open RFC-014 public publisher admission. Third-party Component activation and install admission remain blocked until Project authorization and execution-trust closure are implemented. Current V1 Component storage, catalog, detail, and execution reads enforce exact Workspace/Project data-path isolation. Exact ProjectScope alone is not authorization. Adding quarantine alone would not satisfy or replace either remaining boundary.

A Python package/distribution may export multiple Component symbols. Separately, each portable V1 Component container carries one content/component.json declaration, and a generation-2 container carries several. The multi-declaration container and host presentation contract is the generation-2 contract in Node presentation and third-party UI.

PipelineXLab core includes the Flow calculation path and the sibling Report document. Use px.Flow or PXFLOW Studio to compose the calculation, and px.Report or Report Workbench to author a document and connect its values and result positions. A Component package adds optional Components to the Flow path.

The four levels

Level	Meaning	UI location
Core	Shared SDK, Flow, execution, and Result contract	PXFLOW Studio
Component package	Install and release unit for one or more Components	Project dependencies
Component	One user-visible capability exported by a Component package	Component card
Node	One actual Component placement in the current Flow	Canvas Node

The public target experience will add admitted Component definitions to the catalog and let a user place one in the current Flow. The local-admin package-to-catalog/Canvas bridge exists; the public marketplace and publisher-admission path does not.

Add an optional Component

1. 1Find a ComponentOpen Components · Available in PXFLOW
2. 2Review detailsCheck package, publisher, version, ports, and capabilities
3. 3Add to projectRecord the package release in Project dependencies
4. 4Choose from InstalledOpen the Component contributed by the installed package
5. 5Add to CanvasCreate one Node in the current Flow

Target flow after authorization and trust closure: an admitted package becomes discoverable, and explicit Add creates a host-owned Node projection.

Project dependencies and Components → Installed open only after public admission. The installer retains exact ProjectScope at the data layer but binds no authenticated principal, so an admitted target renders through the declarative body while public admission stays closed.

The planned Project → Dependencies and Project dependencies entries will open one Component package dependency manager. pxlab dependency add is also a planned CLI; neither path currently creates a Project-scoped Component lock.

Extensions and Integrations are broader

An Extension groups an editor, viewer, adapter, or app surface around one or more Components. An Integration connects PipelineXLab to an external product or service. RFC-016 owns the isolated rich-surface runtime; an external publisher package still depends on RFC-014 public admission.

Use the same SDK placement contract

Import px once for PipelineXLab core declarations. Import the installed package as a namespace so its targets remain visibly owned by that package:

from pipelinexlab import px
from midas_civil import components as midas_components


flow = px.Flow(
    "bridge_analysis",
    label="Bridge analysis",
    description="Displays the bridge analysis model.",
)
view = flow.node("model_view", midas_components.model_viewer)

The px. namespace owns root types, markers, and decorators. The flow. namespace owns placement and connections in this Flow. midas_components.model_viewer remains the target exported by the installed package. This is an authoring contract example, not permission to install or run third-party V1 code before Project authorization and execution-trust closure. Use flow.connect(...) for each typed Canvas connection. The package detail identifies the exact import module and target names.

Build and place Components

Review the planned installed-Components path in PXFLOW Studio