@doubledigit/cli 0.1.0

package/dist/commands/sync.js

@@ -0,0 +1,34 @@
+/**
+ * dd sync — Regenerate micro-apps.ts and payload-plugins.ts from config + discovered packages.
+ */
+import { resolveWorkspacePaths } from '../paths.js';
+import { readConfig, isEntryEnabled } from '../config.js';
+import { scanWorkspace } from '../scanner.js';
+import { writeMicroAppsModule, writePayloadPluginsModule } from '../codegen.js';
+export async function sync() {
+    const paths = resolveWorkspacePaths();
+    const config = readConfig(paths.configPath);
+    const { microApps: allApps, payloadPlugins } = scanWorkspace(paths);
+    // Apply DD_APPS env var override (micro-apps only)
+    const envApps = process.env.DD_APPS;
+    let enabledApps = allApps;
+    if (envApps) {
+        const whitelist = new Set(envApps.split(',').map((s) => s.trim()).filter(Boolean));
+        enabledApps = allApps.filter((app) => whitelist.has(app.key));
+        console.log(`📋 DD_APPS override: ${[...whitelist].join(', ')}`);
+    }
+    else if (config.apps) {
+        enabledApps = allApps.filter((app) => isEntryEnabled(config.apps[app.key]));
+    }
+    writeMicroAppsModule(paths.microAppsOutputPath, allApps);
+    writePayloadPluginsModule(paths.payloadPluginsOutputPath, payloadPlugins);
+    console.log(`✅ Synced ${enabledApps.length}/${allApps.length} micro-apps → micro-apps.ts`);
+    for (const app of allApps) {
+        const isEnabled = enabledApps.some((e) => e.key === app.key);
+        console.log(`   ${isEnabled ? '✅' : '❌'} ${app.key} (${app.npmName})`);
+    }
+    console.log(`✅ Synced ${payloadPlugins.length} payload plugin(s) → payload-plugins.ts`);
+    for (const plugin of payloadPlugins) {
+        console.log(`   🔌 ${plugin.key} (${plugin.npmName})`);
+    }
+}

package/dist/commands/uninstall.d.ts

@@ -0,0 +1,14 @@
+/**
+ * dd uninstall <name> — Completely remove a micro-app from the workspace.
+ *
+ * Steps:
+ * 1. Resolve the actual npm package name (from package.json or lock file)
+ * 2. Remove dependency from main-app/package.json
+ * 3. Remove TS path mappings from tsconfig.base.json and apps/main-app/tsconfig.json
+ * 4. Remove entry from dd-apps.config.json
+ * 5. Remove entry from dd-apps.lock.json
+ * 6. Run sync to regenerate micro-apps.ts
+ * 7. Delete the package directory
+ */
+export declare function uninstall(name: string): Promise<void>;
+//# sourceMappingURL=uninstall.d.ts.map

package/dist/commands/uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../../src/commands/uninstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6CH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0J3D"}

package/dist/commands/uninstall.js

@@ -0,0 +1,190 @@
+/**
+ * dd uninstall <name> — Completely remove a micro-app from the workspace.
+ *
+ * Steps:
+ * 1. Resolve the actual npm package name (from package.json or lock file)
+ * 2. Remove dependency from main-app/package.json
+ * 3. Remove TS path mappings from tsconfig.base.json and apps/main-app/tsconfig.json
+ * 4. Remove entry from dd-apps.config.json
+ * 5. Remove entry from dd-apps.lock.json
+ * 6. Run sync to regenerate micro-apps.ts
+ * 7. Delete the package directory
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import { resolveWorkspacePaths, installProbePaths } from '../paths.js';
+import { readConfig, writeConfig } from '../config.js';
+import { sync } from './sync.js';
+import { readLockFile, writeLockFile } from '../lib/lock-file.js';
+import { readManagedPackageMetadata } from '../lib/validators.js';
+/** Resolve the actual npm package name for a micro-app. */
+function resolveNpmName(name, targetDir, lockFilePath) {
+    // First try: read from the package's own package.json (most reliable)
+    const pkgJsonPath = path.join(targetDir, 'package.json');
+    if (fs.existsSync(pkgJsonPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+            if (pkg.name && typeof pkg.name === 'string') {
+                return pkg.name;
+            }
+        }
+        catch {
+            // Fall through to lock file
+        }
+    }
+    // Second try: read from lock file (survives manual directory deletion)
+    try {
+        const lock = readLockFile(lockFilePath);
+        if (lock.apps[name]?.npmName) {
+            return lock.apps[name].npmName;
+        }
+    }
+    catch {
+        // Fall through to default
+    }
+    // Fallback: conventional scope
+    return `@doubledigit/${name}`;
+}
+export async function uninstall(name) {
+    const paths = resolveWorkspacePaths();
+    let lockEntry;
+    try {
+        lockEntry = readLockFile(paths.lockFilePath).apps[name];
+    }
+    catch {
+        lockEntry = undefined;
+    }
+    const candidateDirs = [
+        ...(lockEntry?.installPath ? [path.join(paths.root, lockEntry.installPath)] : []),
+        ...installProbePaths(paths, name, lockEntry?.kind),
+    ];
+    const seenCandidates = new Set();
+    const managedInstalls = candidateDirs
+        .filter((dir) => {
+        if (seenCandidates.has(dir))
+            return false;
+        seenCandidates.add(dir);
+        return fs.existsSync(dir);
+    })
+        .map((dir) => ({
+        dir,
+        ...readManagedPackageMetadata(dir),
+    }))
+        .filter((install) => install.isManagedExtension);
+    const targetDir = managedInstalls[0]?.dir ?? candidateDirs[0];
+    const npmNames = new Set();
+    if (lockEntry?.npmName) {
+        npmNames.add(lockEntry.npmName);
+    }
+    for (const install of managedInstalls) {
+        if (install.npmName) {
+            npmNames.add(install.npmName);
+        }
+    }
+    if (npmNames.size === 0) {
+        npmNames.add(resolveNpmName(name, targetDir, paths.lockFilePath));
+    }
+    const removedKinds = new Set();
+    if (lockEntry?.kind) {
+        removedKinds.add(lockEntry.kind);
+    }
+    for (const install of managedInstalls) {
+        if (install.kind) {
+            removedKinds.add(install.kind);
+        }
+    }
+    const isPayloadPlugin = removedKinds.size > 0 &&
+        removedKinds.has('payload-plugin') &&
+        !removedKinds.has('micro-app');
+    const shouldRemoveConfig = !isPayloadPlugin || removedKinds.has('micro-app');
+    const kindLabel = isPayloadPlugin ? 'payload plugin' : 'micro-app';
+    // Check target doesn't already exist
+    if (managedInstalls.length === 0) {
+        console.warn(`⚠ Directory does not exist: ${targetDir}`);
+    }
+    console.log(`\n🗑️ Uninstalling ${kindLabel}: ${name} (${[...npmNames].join(', ')})`);
+    // 1. Remove dependency from main-app/package.json
+    if (fs.existsSync(paths.mainAppPackageJsonPath)) {
+        const mainPkg = JSON.parse(fs.readFileSync(paths.mainAppPackageJsonPath, 'utf-8'));
+        if (mainPkg.dependencies) {
+            let removedDependency = false;
+            for (const npmName of npmNames) {
+                if (!(npmName in mainPkg.dependencies))
+                    continue;
+                delete mainPkg.dependencies[npmName];
+                removedDependency = true;
+            }
+            if (removedDependency) {
+                fs.writeFileSync(paths.mainAppPackageJsonPath, JSON.stringify(mainPkg, null, 2) + '\n', 'utf-8');
+                console.log(`  ✔ Removed ${[...npmNames].join(', ')} from main-app/package.json`);
+            }
+        }
+    }
+    // 2. Remove TS path mappings
+    const baseTsConfigPath = path.join(paths.root, 'tsconfig.base.json');
+    if (fs.existsSync(baseTsConfigPath)) {
+        const tsconfig = JSON.parse(fs.readFileSync(baseTsConfigPath, 'utf-8'));
+        if (tsconfig.compilerOptions?.paths) {
+            for (const npmName of npmNames) {
+                delete tsconfig.compilerOptions.paths[npmName];
+                delete tsconfig.compilerOptions.paths[`${npmName}/*`];
+            }
+            fs.writeFileSync(baseTsConfigPath, JSON.stringify(tsconfig, null, 2) + '\n', 'utf-8');
+            console.log(`  ✔ Removed ${[...npmNames].join(', ')} paths from tsconfig.base.json`);
+        }
+    }
+    const mainTsConfigPath = path.join(paths.packagesDir, '../apps/main-app/tsconfig.json');
+    if (fs.existsSync(mainTsConfigPath)) {
+        const tsconfig = JSON.parse(fs.readFileSync(mainTsConfigPath, 'utf-8'));
+        if (tsconfig.compilerOptions?.paths) {
+            for (const npmName of npmNames) {
+                delete tsconfig.compilerOptions.paths[npmName];
+                delete tsconfig.compilerOptions.paths[`${npmName}/*`];
+            }
+            fs.writeFileSync(mainTsConfigPath, JSON.stringify(tsconfig, null, 2) + '\n', 'utf-8');
+            console.log(`  ✔ Removed ${[...npmNames].join(', ')} paths from apps/main-app/tsconfig.json`);
+        }
+    }
+    // 3. Remove entry from dd-apps.config.json (micro-app only)
+    if (shouldRemoveConfig) {
+        const config = readConfig(paths.configPath);
+        if (config.apps && config.apps[name] !== undefined) {
+            delete config.apps[name];
+            writeConfig(paths.configPath, config);
+            console.log(`  ✔ Removed ${name} from dd-apps.config.json`);
+        }
+    }
+    // 4. Remove entry from dd-apps.lock.json
+    try {
+        const lock = readLockFile(paths.lockFilePath);
+        if (name in lock.apps) {
+            delete lock.apps[name];
+            writeLockFile(paths.lockFilePath, lock);
+            console.log(`  ✔ Removed ${name} from dd-apps.lock.json`);
+        }
+    }
+    catch {
+        console.warn('  ⚠ Could not update lock file');
+    }
+    // 5. Delete the package directory
+    if (managedInstalls.length > 0) {
+        for (const install of managedInstalls) {
+            fs.rmSync(install.dir, { recursive: true, force: true });
+            console.log(`  ✔ Deleted directory ${install.dir}`);
+        }
+    }
+    // 6. Run sync
+    await sync();
+    // 7. Run pnpm install
+    console.log('\n📦 Running pnpm install to clean up lockfile...');
+    try {
+        execSync('pnpm install', { cwd: paths.root, stdio: 'inherit' });
+    }
+    catch {
+        console.warn('⚠ pnpm install failed. Run it manually.');
+    }
+    console.log(`
+✅ ${isPayloadPlugin ? 'Payload plugin' : 'Micro-app'} "${name}" uninstalled successfully!
+`);
+}

package/dist/config.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Read and write the dd-apps.config.json file.
+ *
+ * Supports both legacy boolean values and extended MicroAppConfigEntry objects:
+ *   { "meal-planner": true }                       // legacy
+ *   { "agent-v2": { "enabled": true, "settings": { "mcp": false } } }  // extended
+ */
+export interface MicroAppConfigEntry {
+    enabled: boolean;
+    settings?: Record<string, unknown>;
+}
+export interface DDAppsConfigFile {
+    apps?: Record<string, boolean | MicroAppConfigEntry>;
+}
+/** Check if an app is enabled, handling both boolean and extended entry. */
+export declare function isEntryEnabled(value: boolean | MicroAppConfigEntry | undefined): boolean;
+export declare function readConfig(configPath: string): DDAppsConfigFile;
+export declare function writeConfig(configPath: string, config: DDAppsConfigFile): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;CACtD;AAMD,4EAA4E;AAC5E,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,GAC/C,OAAO,CAIT;AAMD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAU/D;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAE9E"}

package/dist/config.js

@@ -0,0 +1,37 @@
+/**
+ * Read and write the dd-apps.config.json file.
+ *
+ * Supports both legacy boolean values and extended MicroAppConfigEntry objects:
+ *   { "meal-planner": true }                       // legacy
+ *   { "agent-v2": { "enabled": true, "settings": { "mcp": false } } }  // extended
+ */
+import fs from 'node:fs';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Check if an app is enabled, handling both boolean and extended entry. */
+export function isEntryEnabled(value) {
+    if (value === undefined)
+        return true; // default enabled
+    if (typeof value === 'boolean')
+        return value;
+    return value.enabled;
+}
+// ---------------------------------------------------------------------------
+// Read / Write
+// ---------------------------------------------------------------------------
+export function readConfig(configPath) {
+    if (!fs.existsSync(configPath)) {
+        return { apps: {} };
+    }
+    try {
+        return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+    }
+    catch {
+        console.warn(`⚠ Could not parse ${configPath}, using empty config.`);
+        return { apps: {} };
+    }
+}
+export function writeConfig(configPath, config) {
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * @doubledigit/cli — Manage extensions and local setup for Double Digit.
+ *
+ * Commands are loaded lazily so onboarding/doctor can run from a fresh clone
+ * without importing the full extension-management dependency graph first.
+ */
+declare const command: string, args: string[];
+declare const HELP = "\n@doubledigit/cli \u2014 Manage extensions and local setup\n\nCommands:\n  doctor                 Check local prerequisites and project health\n  onboard                Prepare a local development environment\n  run                    Start the local app with automatic DB bootstrap\n  db <subcommand>        Database helpers (status, migrate)\n  create <name>          Scaffold a new micro-app from the template\n  add <source>           Install an extension from GitHub or a marketplace\n  sync                   Regenerate micro-apps.ts from dd-apps.config.json\n  enable <name>          Enable a micro-app (updates config + runs sync)\n  disable <name>         Disable a micro-app (updates config + runs sync)\n  uninstall <name>       Completely remove a micro-app\n  list                   List all discovered micro-apps with enabled/disabled status\n  info <name>            Show detailed info about an installed extension\n  outdated               Check for outdated marketplace extensions\n  reconcile              Detect drift between lock file, marketplace, and local files\n  marketplace <sub>      Manage marketplace registrations (add/list/update/remove)\n  browse [marketplace]   Browse available extensions in registered marketplaces\n\nOptions:\n  --help, -h             Show this help message\n\nExamples:\n  dd doctor\n  dd onboard --yes --no-start\n  dd run\n  dd db status\n  dd create invoice-tracker\n  dd add gh:owner/repo/extensions/micro-apps/habit-tracker\n  dd add habit-tracker@community\n  dd info habit-tracker\n  dd reconcile\n  dd marketplace add digitaldouble/dd-marketplace\n  dd browse community\n  DD_APPS=tasks,agent-v2 dd sync\n";
+declare function requireArg(value: string | undefined, usage: string): string;
+declare function runAddCommand(rawArgs: string[]): Promise<void>;
+declare function main(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,QAAA,MAAW,OAAO,UAAK,IAAI,UAAgB,CAAC;AAE5C,QAAA,MAAM,IAAI,yoDAqCT,CAAC;AAEF,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED,iBAAe,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB7D;AAED,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmHnC"}

package/dist/index.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * @doubledigit/cli — Manage extensions and local setup for Double Digit.
+ *
+ * Commands are loaded lazily so onboarding/doctor can run from a fresh clone
+ * without importing the full extension-management dependency graph first.
+ */
+const [, , command, ...args] = process.argv;
+const HELP = `
+@doubledigit/cli — Manage extensions and local setup
+
+Commands:
+  doctor                 Check local prerequisites and project health
+  onboard                Prepare a local development environment
+  run                    Start the local app with automatic DB bootstrap
+  db <subcommand>        Database helpers (status, migrate)
+  create <name>          Scaffold a new micro-app from the template
+  add <source>           Install an extension from GitHub or a marketplace
+  sync                   Regenerate micro-apps.ts from dd-apps.config.json
+  enable <name>          Enable a micro-app (updates config + runs sync)
+  disable <name>         Disable a micro-app (updates config + runs sync)
+  uninstall <name>       Completely remove a micro-app
+  list                   List all discovered micro-apps with enabled/disabled status
+  info <name>            Show detailed info about an installed extension
+  outdated               Check for outdated marketplace extensions
+  reconcile              Detect drift between lock file, marketplace, and local files
+  marketplace <sub>      Manage marketplace registrations (add/list/update/remove)
+  browse [marketplace]   Browse available extensions in registered marketplaces
+
+Options:
+  --help, -h             Show this help message
+
+Examples:
+  dd doctor
+  dd onboard --yes --no-start
+  dd run
+  dd db status
+  dd create invoice-tracker
+  dd add gh:owner/repo/extensions/micro-apps/habit-tracker
+  dd add habit-tracker@community
+  dd info habit-tracker
+  dd reconcile
+  dd marketplace add digitaldouble/dd-marketplace
+  dd browse community
+  DD_APPS=tasks,agent-v2 dd sync
+`;
+function requireArg(value, usage) {
+    if (!value) {
+        console.error(`Error: missing required argument. Usage: ${usage}`);
+        process.exit(1);
+    }
+    return value;
+}
+async function runAddCommand(rawArgs) {
+    const positional = [];
+    let forceFlag = false;
+    let nameOverride;
+    for (let i = 0; i < rawArgs.length; i++) {
+        if (rawArgs[i] === '--force') {
+            forceFlag = true;
+        }
+        else if (rawArgs[i] === '--name') {
+            i++;
+            if (i >= rawArgs.length || rawArgs[i].startsWith('--')) {
+                console.error('Error: --name requires a value. Usage: dd add <source> --name <name>');
+                process.exit(1);
+            }
+            nameOverride = rawArgs[i];
+        }
+        else {
+            positional.push(rawArgs[i]);
+        }
+    }
+    const source = requireArg(positional[0], 'dd add <source>');
+    const { add } = await import('./commands/add.js');
+    await add(source, { name: nameOverride, force: forceFlag });
+}
+async function main() {
+    switch (command) {
+        case 'doctor': {
+            const { doctor } = await import('./commands/doctor.js');
+            await doctor();
+            break;
+        }
+        case 'onboard': {
+            const { onboard } = await import('./commands/onboard.js');
+            await onboard(args);
+            break;
+        }
+        case 'run': {
+            const { run } = await import('./commands/run.js');
+            await run();
+            break;
+        }
+        case 'db': {
+            const { db } = await import('./commands/db.js');
+            await db(args);
+            break;
+        }
+        case 'create': {
+            const name = requireArg(args[0], 'dd create <name>');
+            const { create } = await import('./commands/create.js');
+            await create(name);
+            break;
+        }
+        case 'add':
+        case 'install':
+            await runAddCommand(args);
+            break;
+        case 'sync': {
+            const { sync } = await import('./commands/sync.js');
+            await sync();
+            break;
+        }
+        case 'enable': {
+            const name = requireArg(args[0], 'dd enable <name>');
+            const { enable } = await import('./commands/enable.js');
+            await enable(name);
+            break;
+        }
+        case 'disable': {
+            const name = requireArg(args[0], 'dd disable <name>');
+            const { disable } = await import('./commands/disable.js');
+            await disable(name);
+            break;
+        }
+        case 'list': {
+            const { list } = await import('./commands/list.js');
+            await list();
+            break;
+        }
+        case 'uninstall':
+        case 'remove': {
+            const name = requireArg(args[0], 'dd uninstall <name>');
+            const { uninstall } = await import('./commands/uninstall.js');
+            await uninstall(name);
+            break;
+        }
+        case 'marketplace':
+        case 'mp': {
+            const { marketplace } = await import('./commands/marketplace.js');
+            await marketplace(args);
+            break;
+        }
+        case 'browse': {
+            const { browse } = await import('./commands/browse.js');
+            await browse(args);
+            break;
+        }
+        case 'info': {
+            const name = requireArg(args[0], 'dd info <name>');
+            const { info } = await import('./commands/info.js');
+            await info(name);
+            break;
+        }
+        case 'outdated': {
+            const { outdated } = await import('./commands/outdated.js');
+            await outdated();
+            break;
+        }
+        case 'reconcile': {
+            const { reconcile } = await import('./commands/reconcile.js');
+            await reconcile();
+            break;
+        }
+        case '--help':
+        case '-h':
+        case undefined:
+            console.log(HELP);
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            console.log(HELP);
+            process.exit(1);
+    }
+}
+main().catch((err) => {
+    console.error('Fatal error:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});

package/dist/lib/github-auth.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve a GitHub token for private repo access.
+ * Preference order:
+ * 1. GITHUB_TOKEN env var
+ * 2. `gh auth token` from an authenticated GitHub CLI session
+ */
+export declare function resolveGitHubToken(): string | undefined;
+//# sourceMappingURL=github-auth.d.ts.map

package/dist/lib/github-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-auth.d.ts","sourceRoot":"","sources":["../../src/lib/github-auth.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAuBvD"}

package/dist/lib/github-auth.js

@@ -0,0 +1,30 @@
+import { execFileSync } from 'node:child_process';
+let cachedGitHubToken;
+/**
+ * Resolve a GitHub token for private repo access.
+ * Preference order:
+ * 1. GITHUB_TOKEN env var
+ * 2. `gh auth token` from an authenticated GitHub CLI session
+ */
+export function resolveGitHubToken() {
+    if (cachedGitHubToken !== undefined) {
+        return cachedGitHubToken || undefined;
+    }
+    const envToken = process.env.GITHUB_TOKEN?.trim();
+    if (envToken) {
+        cachedGitHubToken = envToken;
+        return envToken;
+    }
+    try {
+        const ghToken = execFileSync('gh', ['auth', 'token'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        cachedGitHubToken = ghToken || null;
+        return ghToken || undefined;
+    }
+    catch {
+        cachedGitHubToken = null;
+        return undefined;
+    }
+}

package/dist/lib/lock-file.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Manage dd-apps.lock.json — tracks externally-installed micro-apps.
+ *
+ * The lock file lives at the monorepo root and records the source,
+ * content hash, and timestamps for every app installed via `dd install`.
+ */
+export interface LockEntry {
+    /** Source URL as provided by the user */
+    source: string;
+    /** Normalized source (gh:owner/repo/path#ref) */
+    resolvedSource: string;
+    /** SHA-256 hash of all files in the installed package */
+    contentHash: string;
+    /** Git ref that was installed (branch, tag, SHA) */
+    ref?: string;
+    /** The actual npm package name from package.json (e.g. @community/habit-tracker) */
+    npmName?: string;
+    /** ISO timestamp of installation */
+    installedAt: string;
+    /** ISO timestamp of last update */
+    updatedAt: string;
+    /** Extension kind */
+    kind?: 'micro-app' | 'payload-plugin';
+    /** Which marketplace this was installed from */
+    marketplace?: string;
+    /** Pinned commit SHA for reproducibility */
+    sha?: string;
+    /** Marketplace version at time of install (e.g. "1.2.0") */
+    marketplaceVersion?: string;
+    /** Relative path within monorepo (e.g. "packages/habit-tracker") */
+    installPath?: string;
+    /** Install strategy used */
+    installStrategy?: 'workspace-vendor' | 'node-modules';
+}
+export interface LockFile {
+    version: 1;
+    apps: Record<string, LockEntry>;
+}
+/**
+ * Read and parse the lock file. Returns an empty lock structure if the file
+ * does not exist. Throws on malformed files to avoid silent data loss.
+ */
+export declare function readLockFile(lockPath: string): LockFile;
+/**
+ * Write the lock file to disk with deterministic key ordering.
+ */
+export declare function writeLockFile(lockPath: string, lock: LockFile): void;
+/**
+ * Add or update a single entry in the lock file.
+ */
+export declare function addLockEntry(lockPath: string, key: string, entry: LockEntry): void;
+/**
+ * Remove an entry from the lock file. No-op if the key doesn't exist.
+ */
+export declare function removeLockEntry(lockPath: string, key: string): void;
+/**
+ * Check whether an app was externally installed (i.e. tracked in the lock file).
+ */
+export declare function isExternalApp(lockPath: string, key: string): boolean;
+/**
+ * Compute a deterministic SHA-256 content hash of every file in a directory.
+ *
+ * Excludes `node_modules`, `.turbo`, and `dist`. File paths are sorted for
+ * determinism and the hash covers both path and content.
+ */
+export declare function computeContentHash(dir: string): Promise<string>;
+//# sourceMappingURL=lock-file.d.ts.map

package/dist/lib/lock-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-file.d.ts","sourceRoot":"","sources":["../../src/lib/lock-file.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,IAAI,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAAC;IACtC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,eAAe,CAAC,EAAE,kBAAkB,GAAG,cAAc,CAAC;CACvD;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACjC;AAOD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAqCvD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAUpE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GACf,IAAI,CAIN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMnE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBrE"}