feat(integrations): artifact-based community installs with import-map runtime

Make community integrations installable in production without rebuilding or
touching the app-api image. Installs land in a bind-mounted
`custom_integrations/` so they survive container replacement; backend code
loads from `dist/backend/index.mjs`, frontend from `dist/frontend/index.js`.
The api never builds, never `pnpm install`s, never imports plugin tooling.

Admin install = artifact only

  Two payload shapes on POST /admin/store/install:
    { repository }                       catalog entry (artifact.url required)
    { artifactUrl, sha256?, version? }   manual install
  Source installs from git remain a CLI-only developer workflow. The
  Install-from-URL dialog drops the Source/Artifact toggle in favour of a
  single artifact URL + optional sha256 form. Updates require the integration
  to be catalog-managed (sourceType=registry + repository match) so we always
  have a fresh artifact URL to install from; `canUpdateFromCatalog` is the
  single helper used by the listing badge, the install endpoint, and the
  store service.

  Drops `OPENMAPX_INTEGRATION_BUILDER_IMAGE` entirely (admin install never
  needs Docker-in-Docker to build) and drops the `git` value from the
  `source_type` enum — only `registry | artifact` now.

CLI build path

  `pnpm openmapx integrations install ./src` and `... package <src> --out
  file.tar.gz` both bundle with esbuild's JS API (`import("esbuild")`), so
  the build only ever runs in the process that has esbuild installed. The
  installer surfaces a clear error if a non-CLI consumer asks for a build.
  Drops the `findEsbuildBinary` lookup-on-disk path, the NODE_PATH
  reconstruction, the `--builder-image` flag on every command, and the
  `validateCommunitySourceBoundary` regex check — esbuild's externals/aliases
  are the contract; disallowed imports fail at bundle time.

Artifact contract

  Tarball ships:
    manifest.json
    dist/frontend/index.js     when frontend components are declared
    dist/backend/index.mjs     when backend code is present
    openmapx-artifact.json     platform version + per-bundle sha256
    strings/<locale>.json      optional
  Explicitly forbidden: node_modules/. Bundles must be self-contained.
  Manifest drops `npmDependencies`, `frontendDependencies`, and
  `runtimeDependencies`. Tar extraction keeps the existing zip-slip,
  symlink/hardlink, and PAX-escape guards.

Frontend runtime singletons via import maps

  Replaces the regex-scraped `window.__openmapx_runtime` shim system with a
  native `<script type="importmap">` in apps/web/src/app/layout.tsx that
  points `react`, `react/jsx-runtime`, `react/jsx-dev-runtime`, and
  `@openmapx/core` at prebuilt ESM files under apps/web/public/runtime/.
  The new apps/web/scripts/build-runtime-modules.mjs runs in `predev` and
  `prebuild` to emit those files via esbuild. Integration bundles keep bare
  `import React from "react"` as externals; the browser resolves them at
  runtime, so React + @openmapx/core stay strict singletons across every
  loaded community bundle and adding a new core export "just works" without
  re-packaging artifacts.

  Drops `coreRuntimeExportNames`, `REACT_RUNTIME_EXPORTS`,
  `CORE_RUNTIME_EXPORT_FALLBACKS`, `writeRuntimeShims`, and the
  `window.__openmapx_runtime` wiring in IntegrationProvider.

Backend reload semantics

  In dev (`NODE_ENV !== "production"`), backend module URLs are still
  mtime-busted so /api/integrations/reload picks up in-place edits. In prod
  the URL is *not* cache-busted — Node's ESM loader returns the cached
  module without leaking memory, so updates to an already-loaded integration
  need `pnpm openmapx services restart app-api`. The install/update job logs
  surface that hint automatically. New installs work without restart.

  Replaces the per-route Fastify registration with a single mini-dispatcher
  + sorted route table so reload genuinely replaces the route map. Pattern
  subset documented inline: literal segments, `:param`, and a trailing `*`.

Tests + typecheck

  Updates packages/cli/__tests__/cli-integrations.test.ts to match the new
  contract (asserts bare-spec externals in the bundle, rejects artifacts
  shipping node_modules/, drops the deprecated-deps tests). All passing:
  packages/cli 129, packages/core 284, apps/api 1069 (+4 skipped).

Author: Medformatik

.dockerignore

@@ -1,13 +1,40 @@
 **/node_modules
 **/.next
 **/.turbo
+.pnpm-store
+.pnp
+.pnp.*
 .git
 .gitignore
+.claude
+.gemini
+.husky
 *.md
 LICENSE
 .env*
 !.env.example
 infra/docker/data
+infra/docker/docker-compose.generated.yml
+infra/docker/docker-compose.generated.hardlinks.json
+infra/docker/service-selection.json
+infra/docker/services/transitous/api-keys.json
+services/motis/tools/transitous/api-keys.json
+services/.community
+custom_integrations
+integrations/*/config.json
 **/.DS_Store
-**/tsconfig.tsbuildinfo
+**/coverage
+apps/api/dist
+services/data-manager/dist
+packages/*/dist
+apps/web/next-env.d.ts
+apps/web/public/sw.js
+apps/web/public/icons/maki
+apps/web/public/icons/temaki
+**/*.tsbuildinfo
+pnpm-debug.log*
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+*.pem
 docs/

.gitignore

@@ -6,15 +6,18 @@
 
 # Dependencies
 node_modules
+.pnpm-store/
 .pnp
 .pnp.js
 
 # Local env files
 .env
+.env.*
 .env.local
 .env.development.local
 .env.test.local
 .env.production.local
+!.env.example
 
 # Testing
 coverage
@@ -35,10 +38,14 @@ dist
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+pnpm-debug.log*
 
 # Playwright
 .playwright-mcp/
 
+# TypeScript
+*.tsbuildinfo
+
 # Misc
 .DS_Store
 *.pem
@@ -54,6 +61,9 @@ infra/docker/data/
 # Community integrations (user-installed, not version-controlled)
 custom_integrations/
 
+# Generated runtime modules served to community integrations via import maps
+apps/web/public/runtime/
+
 # Integration local config (may contain API keys)
 integrations/*/config.json
 
@@ -67,4 +77,5 @@ infra/docker/docker-compose.generated.yml
 infra/docker/docker-compose.generated.hardlinks.json
 infra/docker/service-selection.json
 infra/docker/services/transitous/api-keys.json
+services/motis/tools/transitous/api-keys.json
 services/.community/

.npmrc

@@ -8,7 +8,7 @@
 [![CodeQL](https://github.com/Medformatik/openmapx/actions/workflows/codeql.yml/badge.svg)](https://github.com/Medformatik/openmapx/actions/workflows/codeql.yml)
 [![Docker](https://github.com/Medformatik/openmapx/actions/workflows/docker.yml/badge.svg)](https://github.com/Medformatik/openmapx/actions/workflows/docker.yml)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D24-43853d?logo=node.js&logoColor=white)](https://nodejs.org)
-[![pnpm](https://img.shields.io/badge/pnpm-10-f69220?logo=pnpm&logoColor=white)](https://pnpm.io)
+[![pnpm](https://img.shields.io/badge/pnpm-11-f69220?logo=pnpm&logoColor=white)](https://pnpm.io)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
 [![Next.js](https://img.shields.io/badge/Next.js-16-000?logo=nextdotjs&logoColor=white)](https://nextjs.org)
 [![Fastify](https://img.shields.io/badge/Fastify-5-000?logo=fastify&logoColor=white)](https://fastify.dev)
@@ -120,7 +120,7 @@ pnpm openmapx services enable|disable|list|start|stop|restart|build|status|logs
 pnpm openmapx compose render|up|down
 pnpm openmapx data download|link|status
 pnpm openmapx repos list|add|refresh|remove          # community service repositories
-pnpm openmapx integrations list|install|validate|build
+pnpm openmapx integrations list|install|validate|build|package
 pnpm openmapx users list|create|promote
 pnpm openmapx check                                  # environment + manifest validation
 ```
@@ -151,7 +151,7 @@ See [Admin Panel](https://github.com/Medformatik/openmapx/wiki/Admin-Panel) for
 | Routing & transit | Valhalla, OSRM, MOTIS, OpenTripPlanner |
 | Geocoding | Photon, Nominatim, Pelias |
 | Tiles | TileServer GL, Martin (PostGIS vector tiles) |
-| Tooling | Turborepo, pnpm 10, Biome, Vitest, Husky + Commitlint, Changesets, Docker Compose v2, Traefik |
+| Tooling | Turborepo, pnpm 11, Biome, Vitest, Husky + Commitlint, Changesets, Docker Compose v2, Traefik |
 | Language | TypeScript end-to-end (Node 24+) |
 
 ## Contributing

README.md

@@ -7,7 +7,7 @@ RUN corepack enable && corepack prepare $(node -e "console.log(require('/tmp/pac
 # Install all dependencies (for building)
 FROM base AS deps
 WORKDIR /app
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY packages/core/package.json packages/core/
 COPY packages/shared-mobility/package.json packages/shared-mobility/
 COPY packages/mobility-formats/package.json packages/mobility-formats/
@@ -21,7 +21,7 @@ RUN pnpm install --frozen-lockfile
 # Install production dependencies only (for runtime)
 FROM base AS prod-deps
 WORKDIR /app
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY packages/core/package.json packages/core/
 COPY packages/shared-mobility/package.json packages/shared-mobility/
 COPY packages/mobility-formats/package.json packages/mobility-formats/
@@ -63,14 +63,18 @@ WORKDIR /app
 # `curl -fs http://localhost:3001/health`). Alpine ships wget but not curl,
 # so we install it explicitly. ca-certificates gives node outgoing HTTPS.
 #
+# git is required by admin Store / community-service repository installs:
+# both the community integration installer and service-repo refresh path clone
+# or fetch allowlisted Git URLs from inside the app-api container.
+#
 # docker-cli + docker-cli-compose enable the admin GUI's service-lifecycle
 # and data-maintenance workflows: admin-ops.ts and admin-cli.ts shell out to
 # `docker compose -f <generated>.yml up/stop/restart` and to `openmapx ...`.
 # The socket itself is mounted via services/app-api/service.json's
 # `@docker-socket` bindMount. Without the CLI in the image those handlers
 # would fail even when the socket is available. Kept behind the same apk
 # install for a single image layer.
-RUN apk add --no-cache curl ca-certificates docker-cli docker-cli-compose
+RUN apk add --no-cache curl ca-certificates git docker-cli docker-cli-compose
 
 ENV NODE_ENV=production
 ENV PORT=3001

apps/api/Dockerfile

@@ -7,7 +7,7 @@ export const installedIntegration = pgTable(
     id: text("id").primaryKey(),
     repository: text("repository").notNull(),
     installedVersion: text("installed_version").notNull(),
-    sourceType: text("source_type").notNull().default("registry"), // registry | git | local
+    sourceType: text("source_type").notNull().default("registry"), // registry | artifact
     installedAt: timestamp("installed_at").defaultNow().notNull(),
     updatedAt: timestamp("updated_at").defaultNow().notNull(),
     installedBy: text("installed_by").references(() => user.id, { onDelete: "set null" }),