@capybara-hq/kernel 0.1.0-rc.14 → 0.1.0-rc.16

package/dist/extensions/admin-view.js

@@ -37,6 +37,8 @@ import { SingleProviderGuard } from "./single-provider.js";
 export { PLUGINS_CHANGED_TOPIC };
 /** 内容寻址的包 → 权限集合（包不可变，缓存安全；只作缓存，不是跨副本状态）。 */
 const PACKAGE_SET_CACHE_MAX = 256;
+/** The most client reports an extension view lists (the newest). */
+const CLIENT_REPORTS_SHOWN = 50;
 /** 空权限集合（包读不到的降级项）。 */
 const EMPTY_SET = buildPermissionSet({
     provides: [],
@@ -390,8 +392,13 @@ let ExtensionAdmin = class ExtensionAdmin {
             .where("en.plugin", "in", names)
             .groupBy("en.plugin")
             .execute()).map((r) => [r.plugin, Number(r.n)]));
+        const { clients, reports } = await this.clientsOf(subjects, rows);
         return subjects.map((s) => {
             const of = items.get(s.name);
+            const clientFields = {
+                client: clients.get(s.name) ?? null,
+                clientReports: reports.get(s.name) ?? [],
+            };
             const builtin = of?.some((i) => i.builtin) === true || s.install?.required === true;
             const scopeInfo = {
                 scope: of?.[0]
@@ -441,6 +448,7 @@ let ExtensionAdmin = class ExtensionAdmin {
                     ...scopeInfo,
                     installSource: install?.source ?? null,
                     uiDropped: this.host.uiDropped(s.name),
+                    ...clientFields,
                     error: s.broken,
                 };
             }
@@ -495,9 +503,79 @@ let ExtensionAdmin = class ExtensionAdmin {
                 ...scopeInfo,
                 installSource: install?.source ?? null,
                 uiDropped: this.host.uiDropped(s.name),
+                ...clientFields,
             };
         });
     }
+    /**
+     * The client build of each subject and its newest reports (at most {@link CLIENT_REPORTS_SHOWN}
+     * per extension, limited in SQL), in two queries over all subjects. The build is the one a live
+     * replica serves (`serving_sha256` of the fresh rows `live`, like the shell reads: the install's
+     * own package when it runs, else the newest still served, e.g. the old one beside an upgrade
+     * awaiting approval or failed); with none served, the install record package's build.
+     */
+    async clientsOf(subjects, live) {
+        const targets = subjects.flatMap((s) => {
+            if (s.install === undefined || s.install === null || s.broken !== undefined)
+                return [];
+            const serving = new Set(live.flatMap((r) => r.plugin === s.name && r.serving_sha256 !== null ? [r.serving_sha256] : []));
+            return [{ plugin: s.name, sha: s.install.sha256, serving }];
+        });
+        const clients = new Map();
+        const reports = new Map();
+        if (targets.length === 0)
+            return { clients, reports };
+        const shas = [...new Set(targets.flatMap((t) => [t.sha, ...t.serving]))];
+        const builds = await this.db
+            .selectFrom("extension_client_builds")
+            .select(["package_sha256", "plugin", "sizes", "api_version", "created_at"])
+            .where("package_sha256", "in", shas)
+            .orderBy("created_at", "desc")
+            .execute();
+        for (const t of targets) {
+            const mine = builds.filter((x) => x.plugin === t.plugin);
+            const b = (t.serving.has(t.sha) ? mine.find((x) => x.package_sha256 === t.sha) : undefined) ??
+                mine.find((x) => t.serving.has(x.package_sha256)) ??
+                (t.serving.size === 0 ? mine.find((x) => x.package_sha256 === t.sha) : undefined);
+            if (b === undefined)
+                continue;
+            clients.set(t.plugin, {
+                build: b.package_sha256,
+                files: Object.entries(b.sizes)
+                    .map(([path, bytes]) => ({ path, bytes }))
+                    .sort((x, y) => x.path.localeCompare(y.path)),
+                apiVersion: b.api_version,
+            });
+        }
+        const built = [...clients].map(([plugin, c]) => ({ plugin, build: c.build }));
+        if (built.length === 0)
+            return { clients, reports };
+        const ranked = this.db
+            .selectFrom("extension_client_reports")
+            .selectAll()
+            .select(sql `row_number() over (partition by plugin order by last_at desc)`.as("rank"))
+            .where((eb) => eb.or(built.map((c) => eb.and([eb("plugin", "=", c.plugin), eb("build", "=", c.build)]))));
+        const rows = await this.db
+            .selectFrom(ranked.as("r"))
+            .selectAll()
+            .where("r.rank", "<=", CLIENT_REPORTS_SHOWN)
+            .orderBy("r.last_at", "desc")
+            .execute();
+        for (const r of rows) {
+            const list = reports.get(r.plugin) ?? [];
+            list.push({
+                orgId: r.org_id,
+                contribution: r.contribution,
+                kind: r.kind,
+                count: r.count,
+                firstAt: r.first_at.toISOString(),
+                lastAt: r.last_at.toISOString(),
+                lastMessage: r.last_message,
+            });
+            reports.set(r.plugin, list);
+        }
+        return { clients, reports };
+    }
 };
 __decorate([
     Transactional()

package/dist/extensions/blobs.d.ts

@@ -1,3 +1,4 @@
+import { ClientBuilds } from "../client/client-builds.service.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -10,6 +11,13 @@ import type { ExtensionPackage } from "./package.js";
  *   extension, F-Q): PG `extension_blobs` (`blob_store = pg`, also limited by `packages.maxBytes`).
  * Each package's location is recorded in `extension_packages.blob_store`; reads follow the record and
  * check the sha256.
+ *
+ * A package with an `extension.client` section also stores its client build (`ClientBuilds`,
+ * client extensions spec §9.1): the client files are read again from the bytes being stored,
+ * checked against the section and written to object storage before the package row's transaction,
+ * and the build row is inserted in that transaction, all under the build's lock. Without object
+ * storage (`ClientBuilds`' own, which the CLI points at its store) such a package is refused
+ * (`storage.unavailable`), so a stored build always has its files.
  */
 /** 取到的包与 sha256 不符（存储里的字节被篡改或损坏）。 */
 export declare class ExtensionBlobIntegrityError extends Error {
@@ -31,6 +39,7 @@ export declare class ExtensionBlobs {
     /** Without an object-store extension (the CLI) packages go to PG. */
     private readonly storage;
     private readonly config;
+    private readonly clientBuilds;
     /**
      * CLI only: packages the CLI process imported itself and reads back before the store, since such
      * a package may be recorded in an object store the CLI cannot read. Each entry's sha256 was
@@ -40,7 +49,7 @@ export declare class ExtensionBlobs {
     private readonly local;
     constructor(db: KernelDb, txHost: TransactionHost, 
     /** Without an object-store extension (the CLI) packages go to PG. */
-    storage: StorageService, config: KernelConfigService);
+    storage: StorageService, config: KernelConfigService, clientBuilds: ClientBuilds);
     /** `packages.maxBytes` (read at every call). */
     private maxBytes;
     /**
@@ -54,6 +63,10 @@ export declare class ExtensionBlobs {
      * (content-addressed, idempotent; replicas writing the same package concurrently is harmless).
      */
     put(p: ExtensionPackage, bytes: Uint8Array, src: ExtensionBlobSource): Promise<void>;
+    /** {@link put} after its checks; `client` for a package with client code (under its lock). */
+    private store;
+    /** The files under `dist/client/` of a package's bytes (sha256 already checked by the caller). */
+    private clientFiles;
     private record;
     /** 已有记录的包：按记录的存放位置检查字节在不在，不在就写回（调用方已校验 sha256）。 */
     private repair;

package/dist/extensions/blobs.js

@@ -9,10 +9,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { createHash } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
+import { ClientBuilds } from "../client/client-builds.service.js";
+import { CLIENT_DIR } from "../client/client-files.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { unpackPackageTgz } from "../packages/tgz.js";
 import { StorageService } from "../storage/storage.service.js";
 /**
  * Content-addressed extension package store (C13): one copy per sha256 of the whole tgz.
@@ -21,6 +24,13 @@ import { StorageService } from "../storage/storage.service.js";
  *   extension, F-Q): PG `extension_blobs` (`blob_store = pg`, also limited by `packages.maxBytes`).
  * Each package's location is recorded in `extension_packages.blob_store`; reads follow the record and
  * check the sha256.
+ *
+ * A package with an `extension.client` section also stores its client build (`ClientBuilds`,
+ * client extensions spec §9.1): the client files are read again from the bytes being stored,
+ * checked against the section and written to object storage before the package row's transaction,
+ * and the build row is inserted in that transaction, all under the build's lock. Without object
+ * storage (`ClientBuilds`' own, which the CLI points at its store) such a package is refused
+ * (`storage.unavailable`), so a stored build always has its files.
  */
 /** 取到的包与 sha256 不符（存储里的字节被篡改或损坏）。 */
 export class ExtensionBlobIntegrityError extends Error {
@@ -39,6 +49,7 @@ let ExtensionBlobs = class ExtensionBlobs {
     txHost;
     storage;
     config;
+    clientBuilds;
     /**
      * CLI only: packages the CLI process imported itself and reads back before the store, since such
      * a package may be recorded in an object store the CLI cannot read. Each entry's sha256 was
@@ -48,11 +59,12 @@ let ExtensionBlobs = class ExtensionBlobs {
     local = new Map();
     constructor(db, txHost, 
     /** Without an object-store extension (the CLI) packages go to PG. */
-    storage, config) {
+    storage, config, clientBuilds) {
         this.db = db;
         this.txHost = txHost;
         this.storage = storage;
         this.config = config;
+        this.clientBuilds = clientBuilds;
     }
     /** `packages.maxBytes` (read at every call). */
     maxBytes() {
@@ -85,16 +97,38 @@ let ExtensionBlobs = class ExtensionBlobs {
         if (createHash("sha256").update(bytes).digest("hex") !== p.sha256) {
             throw new ExtensionBlobIntegrityError(p.sha256);
         }
+        const client = p.section.client;
+        if (client === undefined) {
+            await this.store(p, bytes, src, undefined);
+            return;
+        }
+        // client code is delivered from object storage: refused before anything is written without it
+        this.clientBuilds.assertAvailable();
+        const files = await this.clientFiles(bytes);
+        // one store or delete of this package's client build at a time (ClientBuilds header)
+        await this.clientBuilds.locked(p.sha256, () => this.store(p, bytes, src, { section: client, files }));
+    }
+    /** {@link put} after its checks; `client` for a package with client code (under its lock). */
+    async store(p, bytes, src, client) {
+        const plugin = p.section.manifest.name;
         const existing = await this.db
             .selectFrom("extension_packages")
             .select("blob_store")
             .where("sha256", "=", p.sha256)
             .executeTakeFirst();
         if (existing) {
-            // 记录已在：字节若丢了（对象被删、库被清）就按原存放位置补上
+            // The row is there: bytes that went missing (an object deleted, a database cleared) are
+            // restored where the row says, and so are the client build's files and row
             await this.repair(p.sha256, existing.blob_store, bytes);
+            if (client !== undefined) {
+                await this.clientBuilds.extract(p.sha256, plugin, client.files, client.section);
+            }
             return;
         }
+        // checked and written before the transaction (no object storage call inside one)
+        const build = client !== undefined
+            ? await this.clientBuilds.writeFiles(p.sha256, plugin, client.files, client.section)
+            : undefined;
         const store = src.store ?? (this.storage.available ? "object" : "pg");
         if (store === "object") {
             if (!this.storage.available)
@@ -106,9 +140,14 @@ let ExtensionBlobs = class ExtensionBlobs {
         }
         // the row stores the plugin's extension section as reviewed (without the name / version copy)
         const { name: _name, version: _version, ...section } = p.section;
-        await this.record(p, section, bytes, src, store);
+        await this.record(p, section, bytes, src, store, build);
+    }
+    /** The files under `dist/client/` of a package's bytes (sha256 already checked by the caller). */
+    async clientFiles(bytes) {
+        const files = await unpackPackageTgz(bytes, { maxBytes: this.maxBytes() });
+        return new Map(files.filter((f) => f.path.startsWith(CLIENT_DIR)).map((f) => [f.path, f.data]));
     }
-    async record(p, section, bytes, src, store) {
+    async record(p, section, bytes, src, store, build) {
         const m = p.section.manifest;
         const inserted = await this.db
             .insertInto("extension_packages")
@@ -135,6 +174,9 @@ let ExtensionBlobs = class ExtensionBlobs {
                 .onConflict((oc) => oc.column("sha256").doNothing())
                 .execute();
         }
+        // the build row commits with the package row it references (or after another replica's)
+        if (build !== undefined)
+            await this.clientBuilds.insert(build);
     }
     /** 已有记录的包：按记录的存放位置检查字节在不在，不在就写回（调用方已校验 sha256）。 */
     async repair(sha256, store, bytes) {
@@ -205,7 +247,8 @@ ExtensionBlobs = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(StorageService)),
-    __param(3, Inject(KernelConfigService))
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Inject(ClientBuilds))
 ], ExtensionBlobs);
 export { ExtensionBlobs };
 async function readCapped(body, max) {

package/dist/extensions/guide-places.d.ts

@@ -4,8 +4,10 @@ import type { KernelDb } from "../infra/database/kernel-db.js";
 import type { OrgAction } from "../orgs/roles.js";
 /** Why a known variable has no value: what the web and the `Platform` tool tell the reader. */
 export type UnresolvedReason = 
-/** The target is not saved yet (the webhook URL, a connection name nobody typed). */
+/** The target is not saved yet (the webhook URL). */
 "not_saved"
+/** No name typed yet on the new target's form (a connection name on 新建渠道). */
+ | "no_name"
 /** `http.publicUrl` is not set (the URLs built from it). */
  | "public_url"
 /** `channels.webhookBaseUrl` is not set or unusable. */

package/dist/extensions/guide-places.js

@@ -58,7 +58,7 @@ export async function resolvePlace(ctx) {
         const typed = ctx.query.name?.trim();
         values.connectionName =
             connection?.name ?? (typed === undefined || typed === "" ? null : typed);
-        reasons.connectionName = "not_saved";
+        reasons.connectionName = "no_name";
         if (connection !== undefined) {
             target = { kind: "channel-connection", id: connection.id };
             storedMode = connection.inbound_mode;

package/dist/extensions/host.d.ts

@@ -26,7 +26,8 @@ import { type ExtensionSource, ReplicaStatusStore } from "./sources.js";
 export { deploymentConfigHash };
 /**
  * One item of {@link ExtensionHost.uiContributions}: a UI contribution from the manifest whose slot
- * resolved at load (dropped ones never appear), with its registered view / action (embeds have none).
+ * resolved at load (dropped ones never appear), with its registered view / action (a view's or a
+ * component's; embeds have none).
  */
 export interface LoadedUiContribution {
     plugin: string;
@@ -412,6 +413,10 @@ export declare class ExtensionHost {
     /**
      * 写本副本的加载状态；失败只记 warn（状态是给后台看的，不影响加载）。这一行的版本没加载成（failed / pending）
      * 而本副本仍有别的版本在跑时，记下那个版本（`servingVersion`，后台同时显示「新版失败、旧版仍在服务」）。
+     * `servingSha256` is the package this replica actually serves for the plugin (client code follows
+     * it, client extensions spec §9.3): the row's own package when loaded; for a failed / pending row
+     * the package of the instance still running here (an older one, or the row's own package when it
+     * stays loaded, e.g. beside a provider conflict), else null.
      */
     private writeStatus;
     /**

package/dist/extensions/host.js

@@ -1176,15 +1176,24 @@ let ExtensionHost = class ExtensionHost {
     /**
      * 写本副本的加载状态；失败只记 warn（状态是给后台看的，不影响加载）。这一行的版本没加载成（failed / pending）
      * 而本副本仍有别的版本在跑时，记下那个版本（`servingVersion`，后台同时显示「新版失败、旧版仍在服务」）。
+     * `servingSha256` is the package this replica actually serves for the plugin (client code follows
+     * it, client extensions spec §9.3): the row's own package when loaded; for a failed / pending row
+     * the package of the instance still running here (an older one, or the row's own package when it
+     * stays loaded, e.g. beside a provider conflict), else null.
      */
     async writeStatus(s) {
-        if (s.servingVersion === undefined && (s.state === "failed" || s.state === "pending")) {
-            const cur = this.registry.current(s.plugin);
-            s = {
-                ...s,
-                servingVersion: cur && (cur.sha256 !== s.sha256 || cur.version !== s.version) ? cur.version : null,
-            };
-        }
+        const waiting = s.state === "failed" || s.state === "pending";
+        const cur = waiting ? this.registry.current(s.plugin) : undefined;
+        const other = cur && (cur.sha256 !== s.sha256 || cur.version !== s.version) ? cur : null;
+        s = {
+            ...s,
+            ...(waiting && s.servingVersion === undefined && { servingVersion: other?.version ?? null }),
+            servingSha256: s.servingSha256 !== undefined
+                ? s.servingSha256
+                : s.state === "loaded"
+                    ? s.sha256
+                    : (cur?.sha256 ?? null),
+        };
         if (s.source === "install") {
             if (s.state === "unloaded")
                 this.installRows.delete(s.plugin);
@@ -2103,8 +2112,10 @@ let ExtensionHost = class ExtensionHost {
      */
     uiContributions() {
         return this.registry.all().flatMap((i) => i.ui.map(({ contribution: c, slot, after }) => {
-            const render = c.kind === "view" ? i.uiViews.get(c.id) : undefined;
-            const action = c.kind === "view" ? i.uiActions.get(c.id) : undefined;
+            // a view's, or a component's server view (client extensions spec §5.2); embeds have none
+            const served = c.kind === "view" || c.kind === "component";
+            const render = served ? i.uiViews.get(c.id) : undefined;
+            const action = served ? i.uiActions.get(c.id) : undefined;
             return {
                 plugin: i.name,
                 contribution: c,

package/dist/extensions/package.d.ts

@@ -29,10 +29,11 @@ export { HOST_ZOD_VERSION };
 /** Unpack limits: `maxBytes` is `packages.maxBytes`; the rest default to {@link EXTENSION_PACKAGE_LIMITS}. */
 export type ExtensionPackageLimits = PackageTgzLimits;
 /**
- * Codes of {@link ExtensionPackageError}: an invalid package, a tgz in the pre-0.1.0 format, or a
- * plugin without an extension (nothing to install on the deployment).
+ * Codes of {@link ExtensionPackageError}: an invalid package, a tgz in the pre-0.1.0 format, a
+ * plugin without an extension (nothing to install on the deployment), or client code the
+ * extension manifest does not declare.
  */
-export type ExtensionPackageErrorCode = "extension.package_invalid" | "extension.legacy_format" | "extension.no_extension";
+export type ExtensionPackageErrorCode = "extension.package_invalid" | "extension.legacy_format" | "extension.no_extension" | "client.undeclared";
 /** The extension package is invalid; `issues` lists the problems (English, shown to the admin). */
 export declare class ExtensionPackageError extends Error {
     readonly code: ExtensionPackageErrorCode;

package/dist/extensions/package.js

@@ -111,7 +111,11 @@ function checkModuleGraph(entry, byPath) {
     return issues;
 }
 /** Maps an error of `readPluginPackage` to the extension package error. */
-const fromPluginPackageError = (e) => new ExtensionPackageError(e.issues, e.code === "catalog.legacy_format" ? "extension.legacy_format" : "extension.package_invalid");
+const fromPluginPackageError = (e) => new ExtensionPackageError(e.issues, e.code === "catalog.legacy_format"
+    ? "extension.legacy_format"
+    : e.code === "client.undeclared"
+        ? "client.undeclared"
+        : "extension.package_invalid");
 /**
  * Reads and validates an extension package without running any code from it: a plugin tgz
  * (`readPluginPackage`) with an `extension` section, whose entry's module graph passes the import

package/dist/extensions/permission-set.d.ts

@@ -42,12 +42,20 @@ export interface PermissionSet {
         }[];
         network: string[];
         /**
-         * 界面贡献（`permissions.ui`）：`views` 记入快照但不卡加载（升级时自动补进快照）；
-         * `embeds` 与其他权限一样卡加载。旧快照没有这一项（按空处理）。
+         * Client code (`permissions.client`, client extensions spec §5.4): the plugin ships a browser
+         * bundle that runs with full trust in members' browsers. Sensitive and blocking. Older snapshots
+         * lack it (read as false).
+         */
+        client: boolean;
+        /**
+         * UI contributions (`permissions.ui`): `views` are recorded in the snapshot without blocking the
+         * load (added to the snapshot automatically on upgrade); `embeds` and `components` block the
+         * load like any other permission. Older snapshots lack `ui` or `components` (read as empty).
          */
         ui: {
             views: string[];
             embeds: string[];
+            components: string[];
         };
         /**
          * Setup check ids (`permissions.setupChecks`, setup guides v2 §10.2): recorded and shown at
@@ -100,7 +108,8 @@ export declare function buildPermissionSet(input: {
 }): PermissionSet;
 /**
  * 权限集合的稳定字符串键（排序），如 `provides:channel@1`、`config.org.secret:apiKey`、`table:todos`、
- * `permissions.tools:write`、`permissions.http.public:POST /events`、`ui.view:tasks`、`ui.embed:board`。
+ * `permissions.tools:write`、`permissions.http.public:POST /events`、`ui.view:tasks`、`ui.embed:board`,
+ * `permissions.client`, `ui.component:hud`.
  * 容忍旧快照缺字段（按空处理），快照格式演进时不会抛错。
  */
 export declare function permissionKeys(set: PermissionSet): string[];
@@ -109,6 +118,13 @@ export declare function permissionKeys(set: PermissionSet): string[];
  * Lower-case letters and dots only, as catalog permission keys require (`PERMISSION_KEY_RE`).
  */
 export declare const POLICY_HOOK_KEY_PREFIX = "permissions.hooks.policy:";
+/**
+ * Permission key of client code (`permissions.client`): sensitive and blocking. The key, not the
+ * bundle's bytes, is reviewed: an upgrade that only changes the bundle adds no key.
+ */
+export declare const CLIENT_KEY = "permissions.client";
+/** Key prefix of a client component (`ui.component:<id>`): sensitive and blocking. */
+export declare const UI_COMPONENT_KEY_PREFIX = "ui.component:";
 /** 渲染 schema 视图的权限键前缀：记入快照但不卡加载（见 {@link blockingKeys}）。 */
 export declare const UI_VIEW_KEY_PREFIX = "ui.view:";
 /**

package/dist/extensions/permission-set.js

@@ -107,7 +107,12 @@ export function buildPermissionSet(input) {
                 .map((m) => ({ purpose: m.purpose, kind: m.kind }))
                 .sort((a, b) => cmp(a.purpose, b.purpose)),
             network: sortedUnique(p.network),
-            ui: { views: sortedUnique(p.ui?.views), embeds: sortedUnique(p.ui?.embeds) },
+            client: p.client === true,
+            ui: {
+                views: sortedUnique(p.ui?.views),
+                embeds: sortedUnique(p.ui?.embeds),
+                components: sortedUnique(p.ui?.components),
+            },
             // only when declared: sets (and snapshots) of plugins without setup checks stay as they were
             ...(p.setupChecks && p.setupChecks.length > 0
                 ? { setupChecks: sortedUnique(p.setupChecks) }
@@ -118,7 +123,8 @@ export function buildPermissionSet(input) {
 }
 /**
  * 权限集合的稳定字符串键（排序），如 `provides:channel@1`、`config.org.secret:apiKey`、`table:todos`、
- * `permissions.tools:write`、`permissions.http.public:POST /events`、`ui.view:tasks`、`ui.embed:board`。
+ * `permissions.tools:write`、`permissions.http.public:POST /events`、`ui.view:tasks`、`ui.embed:board`,
+ * `permissions.client`, `ui.component:hud`.
  * 容忍旧快照缺字段（按空处理），快照格式演进时不会抛错。
  */
 export function permissionKeys(set) {
@@ -155,10 +161,14 @@ export function permissionKeys(set) {
         keys.push(`permissions.models:${m.purpose} (${m.kind})`);
     for (const d of p.network ?? [])
         keys.push(`permissions.network:${d}`);
+    if (p.client)
+        keys.push(CLIENT_KEY);
     for (const v of p.ui?.views ?? [])
         keys.push(`${UI_VIEW_KEY_PREFIX}${v}`);
     for (const e of p.ui?.embeds ?? [])
         keys.push(`ui.embed:${e}`);
+    for (const c of p.ui?.components ?? [])
+        keys.push(`${UI_COMPONENT_KEY_PREFIX}${c}`);
     for (const c of p.setupChecks ?? [])
         keys.push(`${SETUP_CHECK_KEY_PREFIX}${c}`);
     if (s.warningsDigest)
@@ -170,6 +180,13 @@ export function permissionKeys(set) {
  * Lower-case letters and dots only, as catalog permission keys require (`PERMISSION_KEY_RE`).
  */
 export const POLICY_HOOK_KEY_PREFIX = "permissions.hooks.policy:";
+/**
+ * Permission key of client code (`permissions.client`): sensitive and blocking. The key, not the
+ * bundle's bytes, is reviewed: an upgrade that only changes the bundle adds no key.
+ */
+export const CLIENT_KEY = "permissions.client";
+/** Key prefix of a client component (`ui.component:<id>`): sensitive and blocking. */
+export const UI_COMPONENT_KEY_PREFIX = "ui.component:";
 /** 渲染 schema 视图的权限键前缀：记入快照但不卡加载（见 {@link blockingKeys}）。 */
 export const UI_VIEW_KEY_PREFIX = "ui.view:";
 /**

package/dist/extensions/permission-view.d.ts

@@ -12,11 +12,11 @@ import type { ExtensionSource } from "./sources.js";
 export declare function reviewHash(set: PermissionSet, warnings?: readonly PackageWarning[]): string;
 /** 权限清单展示用的一组：按类别分组，`sensitive` 标出需要管理员特别留意的类别。 */
 export interface PermissionGroup {
-    category: "provides" | "requires" | "optional" | "config" | "tables" | "secrets" | "storage" | "http" | "publicRoutes" | "tools" | "hooks" | "models" | "network" | "ui";
+    category: "provides" | "requires" | "optional" | "config" | "tables" | "secrets" | "storage" | "http" | "publicRoutes" | "tools" | "hooks" | "models" | "network" | "ui" | "components" | "client";
     /**
-     * Sensitive category: secrets, public routes, tools, hooks; also the "provides" group when it holds
-     * one of {@link SENSITIVE_EXTENSION_POINTS}, and the "UI" group when it holds an embedded app
-     * (embed: the extension's own page in an iframe).
+     * Sensitive category: secrets, public routes, tools, hooks, client components, client code; also
+     * the "provides" group when it holds one of {@link SENSITIVE_EXTENSION_POINTS}, and the "UI" group
+     * (views and embeds) when it holds an embedded app (embed: the extension's own page in an iframe).
      */
     sensitive: boolean;
     items: string[];
@@ -25,10 +25,12 @@ export interface PermissionGroup {
 }
 /**
  * Sensitive reason codes (the UI translates them by code): secrets, public routes, tools, hooks,
- * embedded apps, and sensitive extension points ({@link SENSITIVE_EXTENSION_POINTS}; the code is the
- * extension point name without `@<major>`, with `-` replaced by `_`).
+ * embedded apps, client code and client components (client extensions spec §5.4: code that runs with
+ * full trust in members' browsers), and sensitive extension points
+ * ({@link SENSITIVE_EXTENSION_POINTS}; the code is the extension point name without `@<major>`, with
+ * `-` replaced by `_`).
  */
-export type SensitiveReason = "secrets" | "public_routes" | "tools" | "hooks" | "ui_embed" | "channel" | "directory" | "identity_source" | "sandbox" | "object_store" | "migration_warnings";
+export type SensitiveReason = "secrets" | "public_routes" | "tools" | "hooks" | "ui_embed" | "client_code" | "ui_component" | "channel" | "directory" | "identity_source" | "sandbox" | "object_store" | "migration_warnings";
 /** 权限清单里的一项（分组里的一项，或 `added` 里的一个权限键）。 */
 export interface PermissionItem {
     value: string;
@@ -151,6 +153,35 @@ export interface AdminExtensionView {
         ref: string;
         reason: UiDropReason;
     }[];
+    /**
+     * The client build that runs (client extensions spec §9.1, §9.3, §10.4): the one a live replica
+     * serves (the install's own package when it runs, else the older one still served beside an
+     * upgrade awaiting approval or failed), or the install record package's build when no replica
+     * serves one; its id (the package sha256), every file with its size, and the client API
+     * version; null when that package has no client code (or the view is degraded).
+     */
+    client: {
+        build: string;
+        files: {
+            path: string;
+            bytes: number;
+        }[];
+        apiVersion: number;
+    } | null;
+    /**
+     * Crash and load reports of that build, newest first, at most 50: `orgId` is null for admin
+     * pages and may name an org deleted since (rows stay until the 30-day prune). Empty without a
+     * client build.
+     */
+    clientReports: {
+        orgId: string | null;
+        contribution: string | null;
+        kind: string;
+        count: number;
+        firstAt: string;
+        lastAt: string;
+        lastMessage: string;
+    }[];
     /**
      * Only with status `conflict`: the single-provider extension point and the other extensions that
      * provide it (they keep this one from loading; disabling them loads it, no restart).