feat(extensions): unified extension store backend (bundle installer + catalog + trust)

Implements Phases A+B of the unified extension store
(docs/plans/2026-06-26-unified-extension-store-design.md): one catalog,
trust model, and install record over the two existing backends
(in-process integration artifacts + containerized service repos).

Phase A — bundle install foundation:
- extension.json schema + validator (packages/core extension-schema.ts),
  the bundle primitive: N integrations (sha256-pinned) + N services
  (git ref-pinned) as one versioned unit.
- service --ref pinning + managed_by_extension on service_repository;
  fixes a latent bug where the strip-.git clone made refreshRepo's
  fetch/reset/rev-parse resolve against the monorepo, not the clone —
  refresh now re-clones into a tmp dir, validates, then atomically swaps.
- orchestrated atomic installer (extension-installer.ts): register+pin
  service repos -> enable -> render -> start; install integration
  artifacts -> hot reload; record installed_extension(+components);
  best-effort rollback; remove uninstalls exactly what it placed.

Phase B — catalog + trust backend:
- deterministic service security rating from declared capabilities
  (security-rating.ts), on top of the existing community sandbox.
- extension-store.ts: multi-source catalog, source-anchored trust tiers
  (verified vs community), removed/critical kill-switch, manifest
  resolution, folds the legacy integration catalog as degenerate
  extensions.
- /admin/extensions routes (catalog/installed/install/update/remove/
  sources/refresh) + extension.install/extension.remove jobs.
- installed_extension + installed_extension_component tables;
  managed_by_extension on installed_integration.

Migrations 0008 (service repo pinning) + 0009 (installed_extension).

Author: Medformatik

apps/api/src/db/installed-extension-schema.ts

@@ -0,0 +1,46 @@
+import { index, jsonb, pgTable, primaryKey, text, timestamp } from "drizzle-orm/pg-core";
+import { user } from "./auth-schema";
+
+// An installed Extension *bundle* — the parent record that ties together the
+// per-component substrate (installed_integration rows + service_repository rows)
+// so a bundle installs/updates/removes as one version-coupled unit. A degenerate
+// single-component extension is the common case (a lone integration or service).
+export const installedExtension = pgTable(
+  "installed_extension",
+  {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    // Catalog/source URL the bundle was resolved from (null for raw-URL installs).
+    sourceUrl: text("source_url"),
+    // Effective trust tier resolved at install: built-in | verified | community.
+    sourceTrust: text("source_trust").notNull().default("community"),
+    installedVersion: text("installed_version").notNull(),
+    // Snapshot of the resolved extension.json we installed (what to remove/update).
+    manifest: jsonb("manifest"),
+    installedAt: timestamp("installed_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at").defaultNow().notNull(),
+    installedBy: text("installed_by").references(() => user.id, { onDelete: "set null" }),
+  },
+  (table) => [index("installedExtension_sourceTrust_idx").on(table.sourceTrust)],
+);
+
+// One row per component an extension installed, linking to the per-component
+// substrate (installed_integration.id for integrations, the service id for
+// services). Lets uninstall remove exactly what the extension placed.
+export const installedExtensionComponent = pgTable(
+  "installed_extension_component",
+  {
+    extensionId: text("extension_id")
+      .notNull()
+      .references(() => installedExtension.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(), // "integration" | "service"
+    componentId: text("component_id").notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.extensionId, table.kind, table.componentId] }),
+    index("installedExtensionComponent_componentId_idx").on(table.componentId),
+  ],
+);
+
+export type InstalledExtensionRow = typeof installedExtension.$inferSelect;
+export type InstalledExtensionComponentRow = typeof installedExtensionComponent.$inferSelect;

apps/api/src/db/installed-integration-schema.ts

@@ -11,6 +11,9 @@ export const installedIntegration = pgTable(
     installedAt: timestamp("installed_at").defaultNow().notNull(),
     updatedAt: timestamp("updated_at").defaultNow().notNull(),
     installedBy: text("installed_by").references(() => user.id, { onDelete: "set null" }),
+    // Extension id that owns this integration (installed as part of a bundle).
+    // The standalone integration store skips update/remove of managed rows.
+    managedByExtension: text("managed_by_extension"),
   },
   (table) => [index("installedIntegration_sourceType_idx").on(table.sourceType)],
 );

apps/api/src/db/migrations/0008_service_repo_pinning.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "service_repository" ADD COLUMN "pinned_ref" text;--> statement-breakpoint
+ALTER TABLE "service_repository" ADD COLUMN "managed_by_extension" text;

apps/api/src/db/migrations/0009_installed_extension.sql

@@ -0,0 +1,24 @@
+CREATE TABLE "installed_extension" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"source_url" text,
+	"source_trust" text DEFAULT 'community' NOT NULL,
+	"installed_version" text NOT NULL,
+	"manifest" jsonb,
+	"installed_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"installed_by" text
+);
+--> statement-breakpoint
+CREATE TABLE "installed_extension_component" (
+	"extension_id" text NOT NULL,
+	"kind" text NOT NULL,
+	"component_id" text NOT NULL,
+	CONSTRAINT "installed_extension_component_extension_id_kind_component_id_pk" PRIMARY KEY("extension_id","kind","component_id")
+);
+--> statement-breakpoint
+ALTER TABLE "installed_integration" ADD COLUMN "managed_by_extension" text;--> statement-breakpoint
+ALTER TABLE "installed_extension" ADD CONSTRAINT "installed_extension_installed_by_user_id_fk" FOREIGN KEY ("installed_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "installed_extension_component" ADD CONSTRAINT "installed_extension_component_extension_id_installed_extension_id_fk" FOREIGN KEY ("extension_id") REFERENCES "public"."installed_extension"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "installedExtension_sourceTrust_idx" ON "installed_extension" USING btree ("source_trust");--> statement-breakpoint
+CREATE INDEX "installedExtensionComponent_componentId_idx" ON "installed_extension_component" USING btree ("component_id");