feat: Port Arxiv to the Extension Framework

.secrets.baseline

@@ -2296,7 +2296,7 @@
         "filename": "src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json",
         "hashed_secret": "2317af15ade380e78be36f9ffdc6415d596a8715",
         "is_verified": false,
-        "line_number": 960,
+        "line_number": 961,
         "is_secret": false
       }
     ],
@@ -8253,5 +8253,5 @@
       }
     ]
   },
-  "generated_at": "2026-05-07T19:13:33Z"
+  "generated_at": "2026-05-09T02:20:19Z"
 }

pyproject.toml

@@ -23,6 +23,10 @@ dependencies = [
     # ``pip install langflow`` still pulls the component in -- the AC for B1
     # is "no user-visible change at install time".
     "lfx-duckduckgo>=0.1.0",
+    # Second pilot port (validates src/bundles/PORTING.md): lfx-arxiv ships
+    # ArXivComponent as a standalone Bundle.  Same regular-dep rationale --
+    # ``pip install langflow`` keeps shipping the arxiv component as before.
+    "lfx-arxiv>=0.1.0",
 ]
 
 
@@ -77,6 +81,7 @@ langflow = { workspace = true }
 lfx = { workspace = true }
 langflow-sdk = { workspace = true }
 lfx-duckduckgo = { workspace = true }
+lfx-arxiv = { workspace = true }
 torch = { index = "pytorch-cpu" }
 torchvision = { index = "pytorch-cpu" }
 
@@ -87,6 +92,7 @@ members = [
     "src/lfx",
     "src/sdk",
     "src/bundles/duckduckgo",
+    "src/bundles/arxiv",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -168,7 +174,7 @@ ignore-regex = '.*(Stati Uniti|Tense=Pres).*'
 timeout = 150
 timeout_method = "signal"
 minversion = "6.0"
-testpaths = ["src/backend/tests", "src/lfx/tests"]
+testpaths = ["src/backend/tests", "src/lfx/tests", "src/bundles/arxiv/tests"]
 console_output_style = "progress"
 filterwarnings = [
     "ignore::DeprecationWarning",
@@ -419,6 +425,16 @@ external = ["RUF027"]
     "S104",    # Binding to all interfaces (test servers)
     "S108",    # Insecure temp file usage (safe in tests)
 ]
+"src/bundles/*/tests/*" = [
+    "D1",
+    "PLR2004",
+    "S101",
+    "SLF001",
+    "BLE001",  # allow broad-exception catching in tests
+    "S104",    # Binding to all interfaces (test servers)
+    "S108",    # Insecure temp file usage (safe in tests)
+    "INP001",  # Bundle test dirs are not import packages
+]
 "src/backend/tests/locust/*" = [
     "D1",      # Missing docstrings (CLI tools don't need full docstrings)
     "T201",    # Print statements (needed for CLI output)