@ifc-lite/viewer 1.23.0 → 1.25.0

package/src/services/extensions/idb-storage.ts

@@ -0,0 +1,228 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * IndexedDB-backed implementation of @ifc-lite/extensions' `ExtensionStorage`
+ * interface.
+ *
+ * Two object stores:
+ *   - `extensions`         keyed by extension id           → InstalledExtensionRecord
+ *   - `extension-bundles`  keyed by `<id>@<version>` tuple → Uint8Array
+ *
+ * On startup, we open the database, verify both stores exist, and recreate
+ * the database from scratch if anything is missing (mirrors the recovery
+ * pattern used by `services/ifc-cache.ts`).
+ */
+
+import type {
+  ExtensionStorage,
+  InstalledExtensionRecord,
+} from '@ifc-lite/extensions';
+
+const DB_NAME = 'ifc-lite-extensions';
+/**
+ * Bump this when adding/removing/renaming object stores or indexes.
+ * Every new version MUST extend the `onupgradeneeded` switch below
+ * with an idempotent migration step from `event.oldVersion`.
+ */
+const DB_VERSION = 1;
+const STORE_EXT = 'extensions';
+const STORE_BUNDLES = 'extension-bundles';
+
+let dbPromise: Promise<IDBDatabase> | null = null;
+
+/**
+ * Thrown from any IDB write path when the browser refuses the
+ * operation because the origin's storage quota is exhausted.
+ * Callers (host-installer, host) should catch this specifically and
+ * surface a "free up space / uninstall something" toast — bubbling
+ * the raw `QuotaExceededError` produces a generic console error and
+ * a silent UI.
+ */
+export class ExtensionStorageQuotaError extends Error {
+  readonly cause?: unknown;
+  constructor(operation: string, cause?: unknown) {
+    super(`Browser storage quota exceeded while ${operation}.`);
+    this.name = 'ExtensionStorageQuotaError';
+    this.cause = cause;
+  }
+}
+
+function isQuotaError(err: unknown): boolean {
+  if (!err || typeof err !== 'object') return false;
+  const name = (err as { name?: unknown }).name;
+  return name === 'QuotaExceededError' || name === 'NS_ERROR_DOM_QUOTA_REACHED';
+}
+
+export class IdbExtensionStorage implements ExtensionStorage {
+  async putExtension(record: InstalledExtensionRecord): Promise<void> {
+    const db = await openDatabase();
+    try {
+      await runStore(db, STORE_EXT, 'readwrite', (store) => store.put(record));
+    } catch (err) {
+      if (isQuotaError(err)) {
+        throw new ExtensionStorageQuotaError(
+          `saving extension record "${record.id}"`,
+          err,
+        );
+      }
+      throw err;
+    }
+  }
+
+  async getExtension(id: string): Promise<InstalledExtensionRecord | undefined> {
+    const db = await openDatabase();
+    return runStore(db, STORE_EXT, 'readonly', (store) => store.get(id))
+      .then((v) => (v ? (v as InstalledExtensionRecord) : undefined));
+  }
+
+  async listExtensions(): Promise<InstalledExtensionRecord[]> {
+    const db = await openDatabase();
+    return runStore<InstalledExtensionRecord[]>(db, STORE_EXT, 'readonly', (store) => store.getAll());
+  }
+
+  async deleteExtension(id: string): Promise<void> {
+    const db = await openDatabase();
+    await runStore(db, STORE_EXT, 'readwrite', (store) => store.delete(id));
+    // Cascade: drop bundles for this extension. We can't use runStore
+    // here — it overwrites req.onsuccess to capture the result, which
+    // clobbers the cursor-iteration handler. Roll our own transaction.
+    await new Promise<void>((resolve, reject) => {
+      const tx = db.transaction(STORE_BUNDLES, 'readwrite');
+      const store = tx.objectStore(STORE_BUNDLES);
+      const req = store.openCursor();
+      req.onsuccess = () => {
+        const cursor = req.result;
+        if (!cursor) return;
+        const key = String(cursor.key);
+        if (key.startsWith(`${id}@`)) cursor.delete();
+        cursor.continue();
+      };
+      req.onerror = () => reject(req.error);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+      tx.onabort = () => reject(tx.error);
+    });
+  }
+
+  async putBundle(id: string, version: string, bytes: Uint8Array): Promise<void> {
+    const db = await openDatabase();
+    try {
+      await runStore(db, STORE_BUNDLES, 'readwrite', (store) =>
+        store.put(new Uint8Array(bytes), bundleKey(id, version)),
+      );
+    } catch (err) {
+      if (isQuotaError(err)) {
+        throw new ExtensionStorageQuotaError(
+          `saving bundle bytes for "${id}@${version}" (${bytes.byteLength} bytes)`,
+          err,
+        );
+      }
+      throw err;
+    }
+  }
+
+  async getBundle(id: string, version: string): Promise<Uint8Array | undefined> {
+    const db = await openDatabase();
+    const value = await runStore<Uint8Array | undefined>(
+      db,
+      STORE_BUNDLES,
+      'readonly',
+      (store) => store.get(bundleKey(id, version)),
+    );
+    return value ? new Uint8Array(value) : undefined;
+  }
+
+  async deleteBundle(id: string, version: string): Promise<void> {
+    const db = await openDatabase();
+    await runStore(db, STORE_BUNDLES, 'readwrite', (store) =>
+      store.delete(bundleKey(id, version)),
+    );
+  }
+
+  async clear(): Promise<void> {
+    const db = await openDatabase();
+    await runStore(db, STORE_EXT, 'readwrite', (store) => store.clear());
+    await runStore(db, STORE_BUNDLES, 'readwrite', (store) => store.clear());
+  }
+}
+
+function bundleKey(id: string, version: string): string {
+  return `${id}@${version}`;
+}
+
+function openDatabase(): Promise<IDBDatabase> {
+  if (dbPromise) return dbPromise;
+  dbPromise = new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, DB_VERSION);
+    request.onerror = () => {
+      console.error('[extensions/idb] Failed to open database:', request.error);
+      dbPromise = null;
+      reject(request.error);
+    };
+    request.onupgradeneeded = (event) => {
+      const db = request.result;
+      // Migrations are append-only. When DB_VERSION bumps:
+      //   case 1: ... // run v1→v2 migration here (e.g. add an index)
+      //   case 2: ... // run v2→v3 here
+      // The createObjectStore calls below seed a fresh database (when
+      // event.oldVersion is 0) and remain idempotent for users who land
+      // here because recovery deleted the database below.
+      switch (event.oldVersion) {
+        case 0:
+          db.createObjectStore(STORE_EXT, { keyPath: 'id' });
+          db.createObjectStore(STORE_BUNDLES);
+          break;
+        default:
+          // No-op until a v2+ migration exists. Leaving the switch
+          // explicit keeps the contract visible: every future bump
+          // adds its own case.
+          break;
+      }
+    };
+    request.onsuccess = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE_EXT) || !db.objectStoreNames.contains(STORE_BUNDLES)) {
+        // Recovery: delete and recreate.
+        db.close();
+        dbPromise = null;
+        const del = indexedDB.deleteDatabase(DB_NAME);
+        del.onsuccess = () => openDatabase().then(resolve).catch(reject);
+        del.onerror = () => reject(new Error('Failed to recreate extensions database.'));
+        // Without onblocked, another tab holding a connection makes the
+        // delete request hang indefinitely and openDatabase() never
+        // resolves. Reject explicitly so the caller can surface the issue.
+        del.onblocked = () => reject(new Error(
+          'Extensions database recreation is blocked by another open tab. Close other tabs and reload.',
+        ));
+        return;
+      }
+      resolve(db);
+    };
+  });
+  return dbPromise;
+}
+
+function runStore<T = unknown>(
+  db: IDBDatabase,
+  storeName: string,
+  mode: IDBTransactionMode,
+  fn: (store: IDBObjectStore) => IDBRequest | void,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const tx = db.transaction(storeName, mode);
+    const store = tx.objectStore(storeName);
+    let value: unknown;
+    const req = fn(store);
+    if (req instanceof IDBRequest) {
+      req.onsuccess = () => {
+        value = req.result;
+      };
+      req.onerror = () => reject(req.error);
+    }
+    tx.oncomplete = () => resolve(value as T);
+    tx.onerror = () => reject(tx.error);
+    tx.onabort = () => reject(tx.error);
+  });
+}

package/src/services/extensions/runtime-errors.ts

@@ -0,0 +1,26 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * Helpers for turning runtime errors thrown by extension command
+ * execution into user-facing messages. The sandbox throws
+ * `CapabilityDeniedError` (and friends) by `.name`; we don't want
+ * every callsite re-implementing the discrimination, and we want a
+ * single place to refine the wording when we revisit copy.
+ */
+
+export function describeRunCommandError(commandId: string, err: unknown): string {
+  if (err && typeof err === 'object' && 'name' in err) {
+    const name = (err as { name?: string }).name;
+    const message = err instanceof Error ? err.message : String(err);
+    if (name === 'CapabilityDeniedError') {
+      return (
+        `"${commandId}" tried to use a capability that wasn't granted. ` +
+        `Re-install with the missing capability checked, or skip this action. (${message})`
+      );
+    }
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return `Failed to run "${commandId}": ${message}`;
+}

package/src/services/extensions/sandbox-factory.ts

@@ -0,0 +1,217 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * Adapter — `RuntimeSandboxFactory` backed by `@ifc-lite/sandbox`.
+ *
+ * The viewer's production sandbox is the QuickJS-WASM runtime that the
+ * existing `@ifc-lite/sandbox` package already wraps. This module
+ * adapts that surface into the runtime contract defined by
+ * `@ifc-lite/extensions`:
+ *
+ *   - `RuntimeSandboxHandle.setGlobal(name, value)` is implemented by
+ *     wrapping the value as a JSON literal and pre-defining it on the
+ *     QuickJS realm before each `run`.
+ *   - `RuntimeSandboxHandle.run(source)` evaluates the wrapped source
+ *     via `Sandbox.eval`, maps the returned log entries into the
+ *     runtime's `RuntimeLogEntry` shape.
+ *   - `RuntimeSandboxHandle.dispose()` calls `Sandbox.dispose()`.
+ *
+ * The factory accepts a `BimContext` at construction; that SDK is
+ * passed to every Sandbox created. The capability layer (in
+ * `@ifc-lite/extensions/host`) enforces granular access; the sandbox's
+ * coarse permission flags act as the outer ring.
+ */
+
+import {
+  assertMethodCall,
+  CapabilityDeniedError,
+  type Capability,
+  type RuntimeRunOptions,
+  type RuntimeRunResult,
+  type RuntimeSandboxCreateOptions,
+  type RuntimeSandboxFactory,
+  type RuntimeSandboxHandle,
+} from '@ifc-lite/extensions';
+import { createSandbox, type Sandbox } from '@ifc-lite/sandbox';
+import type { BimContext } from '@ifc-lite/sdk';
+
+export interface SandboxFactoryOptions {
+  sdk: BimContext;
+}
+
+export function createBimSandboxFactory(opts: SandboxFactoryOptions): RuntimeSandboxFactory {
+  return {
+    async create(createOpts: RuntimeSandboxCreateOptions): Promise<RuntimeSandboxHandle> {
+      // Wrap the SDK with a per-method capability gate using the
+      // create-time grants. The outer-ring permission flags already
+      // gate at namespace level (model/viewer/etc.); this Proxy is
+      // the inner ring that flags fine-grained denials like
+      // "granted viewer.colorize but called viewer.fly".
+      const gatedSdk = createOpts.grants
+        ? wrapWithCapabilityGate(opts.sdk, createOpts.grants, createOpts.extensionId)
+        : opts.sdk;
+      const sandbox = await createSandbox(gatedSdk, {
+        permissions: createOpts.permissions,
+        limits: createOpts.limits,
+      });
+      return new BimSandboxHandle(sandbox);
+    },
+  };
+}
+
+/**
+ * Wrap the BimContext so each object-namespace method runs
+ * `assertMethodCall(namespace, method, grants)` before forwarding.
+ *
+ * Implemented as a Proxy on the SDK ROOT — not by enumerating
+ * `Object.keys(sdk)`. The BimContext is a class instance: its
+ * namespaces and top-level methods (`query`, `entity`, `viewer`, …)
+ * live on the prototype, so `Object.keys` returns none of them and a
+ * key-enumerated copy comes out empty — every `bim.*` call then fails
+ * with "<x> is not a function". The root Proxy resolves members via
+ * the prototype chain, so nothing is dropped.
+ *
+ * Top-level functions (e.g. `sdk.query()`, `sdk.entity()`) pass
+ * through ungated — the coarse permission ring already gates whole
+ * namespaces; this inner ring only wraps object-namespace methods
+ * (`sdk.viewer.colorize`, etc.).
+ */
+function wrapWithCapabilityGate(
+  sdk: BimContext,
+  grants: readonly Capability[],
+  extensionId: string,
+): BimContext {
+  const nsCache = new Map<string, unknown>();
+  return new Proxy(sdk as object, {
+    get(target, prop) {
+      const value = (target as Record<string | symbol, unknown>)[prop];
+      if (typeof prop !== 'string') return value;
+      // Functions / primitives pass through; only object namespaces
+      // get the per-method capability gate.
+      if (value === null || typeof value !== 'object') return value;
+      let wrapped = nsCache.get(prop);
+      if (!wrapped) {
+        wrapped = new Proxy(value as object, {
+          get(nsTarget, method) {
+            const m = (nsTarget as Record<string | symbol, unknown>)[method];
+            if (typeof m !== 'function' || typeof method !== 'string') return m;
+            return function gated(this: unknown, ...args: unknown[]) {
+              try {
+                assertMethodCall(prop, method, grants);
+              } catch (err) {
+                if (err instanceof CapabilityDeniedError) {
+                  console.warn(`[ext:${extensionId}] denied ${prop}.${method}: ${err.message}`);
+                }
+                throw err;
+              }
+              return (m as (...a: unknown[]) => unknown).apply(nsTarget, args);
+            };
+          },
+        });
+        nsCache.set(prop, wrapped);
+      }
+      return wrapped;
+    },
+  }) as unknown as BimContext;
+}
+
+class BimSandboxHandle implements RuntimeSandboxHandle {
+  /**
+   * Globals pre-defined for the next `run`, keyed by name so re-setting
+   * a global REPLACES its assignment instead of appending a duplicate.
+   * (A plain accumulating string grew the wrapped source ~54 chars on
+   * every run as `__ifclite_ctx__` was re-set.)
+   */
+  private globals = new Map<string, string>();
+  private disposed = false;
+
+  constructor(private sandbox: Sandbox) {}
+
+  setGlobal(name: string, value: unknown): void {
+    if (this.disposed) throw new Error('Sandbox disposed.');
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name)) {
+      throw new Error(`Invalid global name: ${name}`);
+    }
+    // Special-case `__ifclite_ctx__` — the runtime calls
+    // `setGlobal('__ifclite_ctx__', { bim: <host SDK> })` for every
+    // activate / command-run. The host SDK is the wrapped BimContext
+    // (cyclic Proxies for the inner-ring capability gate) so JSON
+    // serialisation crashes. The bridge has already installed `bim`
+    // inside the QuickJS realm — synthesize ctx from that instead.
+    if (name === '__ifclite_ctx__') {
+      this.globals.set(name, `globalThis.__ifclite_ctx__ = { bim: globalThis.bim };`);
+      return;
+    }
+    // Other globals (test args, synthetic-spec data) are JSON-safe;
+    // serialise so the value crosses the realm boundary intact.
+    let serialised: string;
+    try {
+      serialised = JSON.stringify(value ?? null);
+    } catch (err) {
+      throw new Error(
+        `setGlobal("${name}"): value is not JSON-serialisable (${err instanceof Error ? err.message : err}).`,
+      );
+    }
+    this.globals.set(name, `globalThis.${name} = ${serialised};`);
+  }
+
+  async run(source: string, _opts?: RuntimeRunOptions): Promise<RuntimeRunResult> {
+    if (this.disposed) throw new Error('Sandbox disposed.');
+    const prelude = [...this.globals.values()].join('\n');
+    const wrapped = prelude ? `${prelude}\n${source}` : source;
+    let result;
+    try {
+      result = await this.sandbox.eval(wrapped, { typescript: false });
+    } catch (err) {
+      // QuickJS throws "Lifetime not alive" (QuickJSUseAfterFree) when
+      // a handle is touched after its underlying realm was disposed —
+      // typically because a prior run / flavor switch tore down this
+      // sandbox while the host still held the activation record. Mark
+      // ourselves disposed so the runtime knows to reactivate on the
+      // next call, and surface a clear retry-friendly message.
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/Lifetime not alive|QuickJSUseAfterFree/i.test(msg)) {
+        this.disposed = true;
+        try { this.sandbox.dispose(); } catch { /* already torn down */ }
+        throw new Error(
+          'Sandbox was torn down between activate and run. Click Run again — the runtime will reactivate.',
+        );
+      }
+      throw err;
+    }
+    return {
+      value: result.value,
+      logs: result.logs.map((log) => ({
+        level: log.level === 'log' ? 'log' : log.level,
+        message: log.args.map(stringifyArg).join(' '),
+        timestamp: log.timestamp,
+      })),
+      durationMs: result.durationMs,
+    };
+  }
+
+  /** True iff the sandbox has been torn down (host-disposed or auto-disposed on a Lifetime crash). */
+  get isDisposed(): boolean {
+    return this.disposed;
+  }
+
+  dispose(): void {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.sandbox.dispose();
+  }
+}
+
+function stringifyArg(arg: unknown): string {
+  if (typeof arg === 'string') return arg;
+  try {
+    return JSON.stringify(arg);
+  } catch (err) {
+    // JSON.stringify throws on cycles / BigInt — fall back to String()
+    // but log so we can spot pathological logging in dev.
+    console.warn('[sandbox-factory] non-stringifiable log arg:', err);
+    return String(arg);
+  }
+}

package/src/store/constants.ts

@@ -147,13 +147,55 @@ export const UI_DEFAULTS = {
 // Type Visibility Defaults
 // ============================================================================
 
+/**
+ * localStorage keys for the type-visibility toggles. Each maps to a
+ * single boolean preference; same persistence pattern as
+ * `MERGE_LAYERS_STORAGE_KEY` (`'true'` / `'false'` string, anything
+ * else falls back to the semantic default). One key per toggle so a
+ * user can clear an individual preference without nuking the rest.
+ */
+export const TYPE_VISIBILITY_STORAGE_KEYS = {
+  spaces:         'ifc-lite-ifc-spaces-visible',
+  openings:       'ifc-lite-ifc-openings-visible',
+  site:           'ifc-lite-ifc-site-visible',
+  ifcAnnotations: 'ifc-lite-ifc-annotations-visible',
+} as const;
+
+/** Legacy alias — kept until external callers migrate. */
+export const IFC_ANNOTATIONS_STORAGE_KEY = TYPE_VISIBILITY_STORAGE_KEYS.ifcAnnotations;
+
+function readPersistedBool(key: string, fallback: boolean): boolean {
+  if (typeof window === 'undefined') return fallback;
+  try {
+    const raw = localStorage.getItem(key);
+    if (raw === 'true') return true;
+    if (raw === 'false') return false;
+    return fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+// Semantic defaults applied when no localStorage preference is set.
+// IfcSpace / IfcOpeningElement off — they cover walls and confuse novices
+// on first load. IfcSite + IfcAnnotation/IfcGrid on — both convey
+// design intent users expect to see by default.
+const SEMANTIC_DEFAULTS = {
+  spaces: false,
+  openings: false,
+  site: true,
+  ifcAnnotations: true,
+} as const;
+
 export const TYPE_VISIBILITY_DEFAULTS = {
-  /** IfcSpace visibility - off by default */
-  SPACES: false,
-  /** IfcOpeningElement visibility - off by default */
-  OPENINGS: false,
-  /** IfcSite visibility - on by default (when has geometry) */
-  SITE: true,
+  /** IfcSpace visibility — persisted across reloads. */
+  SPACES:          readPersistedBool(TYPE_VISIBILITY_STORAGE_KEYS.spaces, SEMANTIC_DEFAULTS.spaces),
+  /** IfcOpeningElement visibility — persisted across reloads. */
+  OPENINGS:        readPersistedBool(TYPE_VISIBILITY_STORAGE_KEYS.openings, SEMANTIC_DEFAULTS.openings),
+  /** IfcSite visibility — persisted across reloads. */
+  SITE:            readPersistedBool(TYPE_VISIBILITY_STORAGE_KEYS.site, SEMANTIC_DEFAULTS.site),
+  /** IfcAnnotation + IfcGrid visibility — persisted across reloads. */
+  IFC_ANNOTATIONS: readPersistedBool(TYPE_VISIBILITY_STORAGE_KEYS.ifcAnnotations, SEMANTIC_DEFAULTS.ifcAnnotations),
 } as const;
 
 // ============================================================================

package/src/store/index.ts

@@ -29,6 +29,7 @@ import { createDrawing2DSlice, type Drawing2DSlice } from './slices/drawing2DSli
 import { createSheetSlice, type SheetSlice } from './slices/sheetSlice.js';
 import { createBcfSlice, type BCFSlice } from './slices/bcfSlice.js';
 import { createIdsSlice, type IDSSlice } from './slices/idsSlice.js';
+import { createExtensionsSlice, type ExtensionsSlice } from './slices/extensionsSlice.js';
 import { createListSlice, type ListSlice } from './slices/listSlice.js';
 import { createPinboardSlice, type PinboardSlice } from './slices/pinboardSlice.js';
 import { createLensSlice, type LensSlice } from './slices/lensSlice.js';
@@ -140,7 +141,8 @@ export type ViewerState = LoadingSlice &
   AddElementSlice &
   SplitToolSlice &
   LevelDisplaySlice &
-  PointCloudSlice & {
+  PointCloudSlice &
+  ExtensionsSlice & {
     resetViewerState: () => void;
   };
 
@@ -180,6 +182,7 @@ const createViewerStore = () => create<ViewerState>()((...args) => ({
   ...createSplitToolSlice(...args),
   ...createLevelDisplaySlice(...args),
   ...createPointCloudSlice(...args),
+  ...createExtensionsSlice(...args),
 
   // Reset all viewer state when loading new file
   // Note: Does NOT clear models - use clearAllModels() for that
@@ -204,6 +207,7 @@ const createViewerStore = () => create<ViewerState>()((...args) => ({
         spaces: TYPE_VISIBILITY_DEFAULTS.SPACES,
         openings: TYPE_VISIBILITY_DEFAULTS.OPENINGS,
         site: TYPE_VISIBILITY_DEFAULTS.SITE,
+        ifcAnnotations: TYPE_VISIBILITY_DEFAULTS.IFC_ANNOTATIONS,
       },
 
       // Visibility (multi-model)
@@ -301,6 +305,7 @@ const createViewerStore = () => create<ViewerState>()((...args) => ({
         show3DOverlay: true,
         scale: 100,
         useSymbolicRepresentations: false,
+        showIfcAnnotations: true,
       },
       // Graphic overrides (keep presets, reset active and custom)
       activePresetId: 'preset-3d-colors',

package/src/store/slices/drawing2DSlice.ts

@@ -91,6 +91,13 @@ export interface Drawing2DState {
     scale: number;
     /** Use authored symbolic representations (Plan/Annotation) when available instead of section cut */
     useSymbolicRepresentations: boolean;
+    /**
+     * Whether to overlay IfcAnnotation curves, text, and fills on the 2D
+     * section view. Filtered to annotations whose world position falls
+     * inside the section's view-range on the cut axis (issue #812 follow-up
+     * to the IfcAnnotation text feature).
+     */
+    showIfcAnnotations: boolean;
   };
   /** Available graphic override presets */
   graphicOverridePresets: GraphicOverridePreset[];
@@ -236,6 +243,7 @@ const getDefaultDisplayOptions = (): Drawing2DState['drawing2DDisplayOptions'] =
   show3DOverlay: true, // Show 3D overlay by default
   scale: 100, // 1:100 default
   useSymbolicRepresentations: false, // Default to section cut (Body geometry)
+  showIfcAnnotations: true, // Mirror the 3D Class Visibility default
 });
 
 const getDefaultState = (): Drawing2DState => ({

package/src/store/slices/extensionsSlice.ts

@@ -0,0 +1,90 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * Extensions panel visibility slice.
+ *
+ * The extension system's actual state lives in the host service
+ * (services/extensions/host.ts) — installed bundles, audit log, slot
+ * contributions. The store only owns the UI-toggle state so panel
+ * visibility behaves like every other dock panel (IDS, BCF, Lens,
+ * Lists, Script).
+ */
+
+import type { StateCreator } from 'zustand';
+
+export type ExtensionsTabView = 'installed' | 'ideas' | 'audit' | 'repair' | 'privacy';
+
+export interface ExtensionsSlice {
+  extensionsPanelVisible: boolean;
+  setExtensionsPanelVisible: (visible: boolean) => void;
+  toggleExtensionsPanel: () => void;
+  /**
+   * Bytes of an authored bundle waiting for the user to review. The
+   * chat-side authoring loop sets this on success; the Extensions
+   * panel picks it up on mount, routes through CapabilityReview, and
+   * clears the slot after install or cancel.
+   */
+  pendingAuthoredBundle: Uint8Array | null;
+  setPendingAuthoredBundle: (bytes: Uint8Array | null) => void;
+  /**
+   * Which tab the Extensions panel should show. Set by deep-link
+   * entry points (Command Palette "Author an extension…", chat
+   * routing after a successful authoring loop) so the panel mounts
+   * straight into the right surface.
+   */
+  extensionsRequestedView: ExtensionsTabView | null;
+  setExtensionsRequestedView: (view: ExtensionsTabView | null) => void;
+  /**
+   * When true, the IdeasPanel should open the Plan Card in
+   * empty-plan mode on mount. Consumed once then cleared.
+   */
+  ideasOpenEmptyPlan: boolean;
+  setIdeasOpenEmptyPlan: (open: boolean) => void;
+  /**
+   * When true, the FlavorDialog should auto-open. Consumed once
+   * then cleared by the dialog wrapper.
+   */
+  flavorDialogRequested: boolean;
+  setFlavorDialogRequested: (open: boolean) => void;
+  /**
+   * Post-authoring "install" handoff. After the chat finishes an
+   * authoring turn, it sets this so the chat panel can render a
+   * prominent inline CTA — the user no longer has to hunt for a
+   * Promote button in another panel.
+   *
+   *   kind 'bundle' — a full `.iflx` bundle was synthesised and is
+   *                   waiting in `pendingAuthoredBundle`; the CTA
+   *                   routes to the Extensions panel review.
+   *   kind 'script' — the assistant wrote a one-shot script into the
+   *                   editor; the CTA opens PromoteToolDialog.
+   *
+   * Cleared when the user acts on it, dismisses it, or starts a new
+   * chat.
+   */
+  chatToolReady: { kind: 'bundle' | 'script'; name: string } | null;
+  setChatToolReady: (v: { kind: 'bundle' | 'script'; name: string } | null) => void;
+}
+
+export const createExtensionsSlice: StateCreator<
+  ExtensionsSlice,
+  [],
+  [],
+  ExtensionsSlice
+> = (set) => ({
+  extensionsPanelVisible: false,
+  setExtensionsPanelVisible: (extensionsPanelVisible) => set({ extensionsPanelVisible }),
+  toggleExtensionsPanel: () =>
+    set((state) => ({ extensionsPanelVisible: !state.extensionsPanelVisible })),
+  pendingAuthoredBundle: null,
+  setPendingAuthoredBundle: (pendingAuthoredBundle) => set({ pendingAuthoredBundle }),
+  extensionsRequestedView: null,
+  setExtensionsRequestedView: (extensionsRequestedView) => set({ extensionsRequestedView }),
+  ideasOpenEmptyPlan: false,
+  setIdeasOpenEmptyPlan: (ideasOpenEmptyPlan) => set({ ideasOpenEmptyPlan }),
+  flavorDialogRequested: false,
+  setFlavorDialogRequested: (flavorDialogRequested) => set({ flavorDialogRequested }),
+  chatToolReady: null,
+  setChatToolReady: (chatToolReady) => set({ chatToolReady }),
+});