@tapestry-mud/cli 0.3.11 → 0.5.0

package/SECURITY.md

@@ -0,0 +1,93 @@
+# Security Policy
+
+We take the security of Tapestry and its surrounding tooling seriously. This
+document explains how to report a vulnerability and what we do to keep the
+project and its supply chain safe.
+
+## Reporting a Vulnerability
+
+**Please do not open a public issue or pull request for security problems.**
+Public reports tip off attackers before a fix is available.
+
+Instead, report privately through GitHub:
+
+1. Go to this repository's **Security** tab.
+2. Click **Report a vulnerability** (GitHub Private Vulnerability Reporting).
+3. Describe the issue, the affected version or commit, and steps to reproduce.
+
+If you can include a proof of concept, impact assessment, or suggested fix, that
+helps us triage faster — but it isn't required to file a report.
+
+### What to expect
+
+- **A best-effort acknowledgement within 72 hours** of your report.
+- An assessment and, where confirmed, a plan and rough timeline for a fix.
+- **Coordinated disclosure:** we develop and release the fix before publishing
+  details, then credit you in the advisory unless you'd prefer to remain
+  anonymous.
+
+This is a small, fast-moving project, so timelines are best-effort — but we will
+keep you informed.
+
+## Supported Versions
+
+Tapestry is pre-1.0 and moves quickly. Security fixes are applied to the latest
+release and the `master` branch only.
+
+| Version            | Supported          |
+| ------------------ | ------------------ |
+| Latest release     | :white_check_mark: |
+| `master` (default) | :white_check_mark: |
+| Older releases     | :x:                |
+
+If you're running an older tagged release, upgrade to the latest before
+reporting — the issue may already be fixed.
+
+## How We Protect the Supply Chain
+
+Supply-chain attacks (compromised dependencies, malicious package updates,
+hijacked CI) are a primary threat for any project that publishes artifacts. Our
+standing measures:
+
+- **Exact-pinned dependencies.** Every dependency is pinned to an exact version
+  — no `^` or `~` ranges — so a malicious upstream release can't be pulled in
+  silently by a version range.
+- **Install cooldown for new packages.** Package installs enforce a minimum
+  release age, so freshly published versions are not installed immediately. This
+  blunts worm-style compromises that rely on rapid propagation in the hours
+  after a malicious release.
+- **CI actions pinned to commit SHAs.** GitHub Actions are referenced by full
+  commit SHA rather than mutable tags, so a retagged or hijacked action can't
+  alter our builds.
+- **Least-privilege CI.** Workflows declare scoped `permissions:` blocks and use
+  short-lived, narrowly scoped credentials — the built-in `GITHUB_TOKEN`,
+  OpenID Connect (OIDC) tokens, and scoped GitHub App tokens — instead of
+  long-lived personal access tokens or stored secrets.
+- **Protected default branch.** Changes to `master` require a pull request, at
+  least one review, and passing status checks before merge.
+
+## For Contributors and Pack Authors
+
+- **Don't introduce unpinned dependencies.** Match the existing exact-version
+  pinning. PRs that add `^`/`~` ranges will be asked to pin.
+- **Report suspicious dependency behavior.** If a dependency starts doing
+  something unexpected — unfamiliar network calls, new lifecycle scripts,
+  surprising postinstall steps — report it via the process above.
+- **Treat third-party content packs as untrusted.** Packs execute JavaScript
+  (via Jint) inside the engine. Only run packs you trust, and review pack
+  scripts before loading them into a server you care about.
+
+## Scope
+
+**In scope:** the Tapestry engine, registry, CLI, web client, and the official
+content-pack tooling maintained under the `tapestry-mud` organization.
+
+**Out of scope:**
+
+- Misconfiguration of your own self-hosted deployment (firewall rules, exposed
+  admin ports, weak operator passwords, etc.).
+- Third-party or community content packs not authored by this project.
+- Vulnerabilities in upstream dependencies — report those upstream, though we
+  appreciate a heads-up so we can pin around them.
+
+Thank you for helping keep Tapestry and its users safe.

package/bin/tapestry.js

@@ -18,6 +18,7 @@ const { publish } = require('../src/commands/publish');
 const { search } = require('../src/commands/search');
 const { info } = require('../src/commands/info');
 const { list } = require('../src/commands/list');
+const { link, unlink, linkList } = require('../src/commands/link');
 const { outdated } = require('../src/commands/outdated');
 const { engineInstall, engineUpdate, engineInfo } = require('../src/commands/engine');
 const { engineVersions } = require('../src/commands/engine-versions');
@@ -40,7 +41,7 @@ program.configureHelp({
     const groups = [
       {
         title: 'Pack Management',
-        commands: ['uninstall', 'update', 'list', 'enable', 'disable', 'outdated'],
+        commands: ['uninstall', 'update', 'list', 'enable', 'disable', 'outdated', 'link', 'unlink'],
       },
       {
         title: 'Engine',
@@ -255,7 +256,7 @@ program
 
 program
   .command('validate')
-  .description('Validate tapestry.yaml in the current directory')
+  .description('Validate pack.yaml in the current directory')
   .action(() => {
     try {
       validate();
@@ -337,6 +338,35 @@ program
     }
   });
 
+program
+  .command('link [path]')
+  .description('Attach a local pack working copy to this project (use --list to show links)')
+  .option('--list', 'List active links instead of creating one')
+  .action(async (linkPath, options) => {
+    try {
+      if (options.list || !linkPath) {
+        await linkList();
+      } else {
+        await link(linkPath);
+      }
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+program
+  .command('unlink <name>')
+  .description('Detach a linked pack and restore the registry copy on next install')
+  .action(async (name) => {
+    try {
+      await unlink(name);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
 const engineCmd = program.command('engine').description('Manage the Tapestry engine');
 
 engineCmd

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@tapestry-mud/cli",
-  "version": "0.3.11",
+  "version": "0.5.0",
   "description": "CLI for the Tapestry MUD engine",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tapestry-mud/tapestry-cli.git"
+  },
   "bin": {
     "tapestry": "./bin/tapestry.js"
   },
@@ -12,16 +16,16 @@
     "access": "public"
   },
   "dependencies": {
-    "commander": "^11.1.0",
-    "form-data": "^4.0.5",
-    "inquirer": "^8.2.6",
-    "js-yaml": "^4.1.0",
-    "node-fetch": "^2.7.0",
-    "semver": "^7.6.2",
-    "tar": "^7.5.15",
-    "zod": "^3.22.4"
+    "commander": "11.1.0",
+    "form-data": "4.0.5",
+    "inquirer": "8.2.7",
+    "js-yaml": "4.1.1",
+    "node-fetch": "2.7.0",
+    "semver": "7.6.2",
+    "tar": "7.5.15",
+    "zod": "3.22.4"
   },
   "devDependencies": {
-    "jest": "^29.7.0"
+    "jest": "29.7.0"
   }
 }

package/src/commands/create-pack.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const { generatePackFiles } = require('../scaffold/templates');
+const { PACK_MANIFEST } = require('../lib/manifest');
 
 function parseName(name) {
   const scopedMatch = name.match(/^@([a-z0-9-]+)\/([a-z0-9-]+)$/);
@@ -59,7 +60,7 @@ function createPack(name, cwd) {
         console.log(`  ${file.path}`);
       }
     }
-    console.log('\nEdit tapestry.yaml, then run: tapestry validate');
+    console.log(`\nEdit ${PACK_MANIFEST}, then run: tapestry validate`);
   }
 }
 

package/src/commands/init.js

@@ -238,7 +238,7 @@ async function init(cwd, { registryUrl = DEFAULT_REGISTRY, yes = false, prompter
   fs.mkdirSync(path.join(cwd, 'packs'), { recursive: true });
   fs.writeFileSync(
     path.join(cwd, '.gitignore'),
-    '# Installed packages (managed by tapestry install)\npacks/\n\n# Engine artifacts (managed by tapestry engine install)\n.tapestry-engine/\n\n# Game data (players, saves)\ndata/\n'
+    '# Installed packages (managed by tapestry install)\npacks/\n\n# Local pack links (managed by tapestry link)\ntapestry-links.yaml\n\n# Engine artifacts (managed by tapestry engine install)\n.tapestry-engine/\n\n# Game data (players, saves)\ndata/\n'
   );
 
   console.log('');

package/src/commands/install.js

@@ -10,6 +10,8 @@ const { fetchTarball, DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { verifyIntegrity, saveTarball, extractTarball } = require('../lib/tarball');
 const { addPackageToBoot } = require('../lib/boot');
 const { loadToken } = require('../lib/auth');
+const { PACK_MANIFEST } = require('../lib/manifest');
+const { readLinks } = require('../lib/links');
 
 function packInstallPath(cwd, packageName) {
   const parts = packageName.split('/');
@@ -33,11 +35,16 @@ function isLockCurrent(manifestDeps, lock) {
 }
 
 async function installResolved(cwd, resolved, token) {
+  const { links } = readLinks(cwd);
   for (const [packageName, info] of Object.entries(resolved)) {
+    if (packageName in links) {
+      console.log(`  skipping ${packageName} (linked)`);
+      continue;
+    }
     const destDir = packInstallPath(cwd, packageName);
 
     if (fs.existsSync(destDir)) {
-      const installedManifestPath = path.join(destDir, 'tapestry.yaml');
+      const installedManifestPath = path.join(destDir, PACK_MANIFEST);
       if (fs.existsSync(installedManifestPath)) {
         const installed = readYaml(installedManifestPath);
         if (installed.version === info.version) {
@@ -67,7 +74,7 @@ async function installResolved(cwd, resolved, token) {
       }
     }
 
-    const packManifest = readYaml(path.join(destDir, 'tapestry.yaml'));
+    const packManifest = readYaml(path.join(destDir, PACK_MANIFEST));
     addPackageToBoot(cwd, packageName, packManifest);
   }
 }
@@ -97,13 +104,22 @@ async function install(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_
 
     writeYaml(manifestPath, manifest);
   } else {
+    const { links } = readLinks(cwd);
+    for (const name of Object.keys(links)) {
+      if ((manifest.dependencies || {})[name] !== undefined) {
+        console.log(`  skipping ${name} (linked)`);
+      }
+    }
+    const depsToResolve = Object.fromEntries(
+      Object.entries(manifest.dependencies || {}).filter(([name]) => !(name in links))
+    );
     const lock = readLock(cwd);
-    if (lock && isLockCurrent(manifest.dependencies || {}, lock)) {
+    if (lock && isLockCurrent(depsToResolve, lock)) {
       console.log('Installing from lock file...');
       resolved = lock.resolved;
     } else {
       console.log('Resolving dependencies...');
-      resolved = await resolve(manifest.dependencies || {}, registryUrl, token);
+      resolved = await resolve(depsToResolve, registryUrl, token);
     }
   }
 

package/src/commands/link.js

@@ -0,0 +1,79 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  readLinks, addLink, removeLink, readPackManifest,
+  removeMaterializedLink, checkMissingDeps,
+} = require('../lib/links');
+const { addPackageToBoot, removePackageFromBoot } = require('../lib/boot');
+
+function requireProject(cwd) {
+  if (!fs.existsSync(path.join(cwd, 'tapestry.yaml'))) {
+    throw new Error('No tapestry.yaml found. Run `tapestry init` first.');
+  }
+}
+
+function ensureGitignore(cwd) {
+  const gi = path.join(cwd, '.gitignore');
+  if (!fs.existsSync(gi)) {
+    return;
+  }
+  const body = fs.readFileSync(gi, 'utf8');
+  if (!body.split(/\r?\n/).includes('tapestry-links.yaml')) {
+    fs.appendFileSync(gi, `${body.endsWith('\n') ? '' : '\n'}tapestry-links.yaml\n`);
+  }
+}
+
+async function link(targetPath, { cwd = process.cwd() } = {}) {
+  requireProject(cwd);
+  const absPath = path.resolve(cwd, targetPath);
+  if (!fs.existsSync(absPath)) {
+    throw new Error(`Path not found: ${absPath}`);
+  }
+  const manifest = readPackManifest(absPath);
+  const name = manifest.name;
+  if (!name) {
+    throw new Error(`Pack at ${absPath} has no 'name' in its manifest`);
+  }
+
+  addLink(cwd, name, absPath);
+  addPackageToBoot(cwd, name, manifest);
+  ensureGitignore(cwd);
+
+  console.log(`linked ${name} -> ${absPath}`);
+
+  if (manifest.active === false) {
+    console.warn(`  warning: ${name} is marked active: false; it will not load until activated`);
+  }
+  for (const dep of checkMissingDeps(cwd, manifest)) {
+    const range = manifest.dependencies[dep];
+    console.warn(`  warning: missing dependency ${dep} (${range}) -- run: tapestry install ${dep}`);
+  }
+}
+
+async function unlink(name, { cwd = process.cwd() } = {}) {
+  requireProject(cwd);
+  if (!removeLink(cwd, name)) {
+    throw new Error(`${name} is not linked`);
+  }
+  removeMaterializedLink(cwd, name);
+  removePackageFromBoot(cwd, name);
+  console.log(`unlinked ${name}`);
+  console.log(`  run 'tapestry install' to restore the registry copy`);
+}
+
+async function linkList({ cwd = process.cwd() } = {}) {
+  const { links } = readLinks(cwd);
+  const entries = Object.entries(links);
+  if (entries.length === 0) {
+    console.log('No linked packs.');
+    return;
+  }
+  for (const [name, absPath] of entries) {
+    const flag = fs.existsSync(absPath) ? '' : '  (MISSING)';
+    console.log(`${name} -> ${absPath}${flag}`);
+  }
+}
+
+module.exports = { link, unlink, linkList };

package/src/commands/list.js

@@ -5,6 +5,8 @@ const path = require('path');
 const { readLock } = require('../lib/lock-file');
 const { readBoot } = require('../lib/boot');
 const { readYaml } = require('../util/yaml');
+const { PACK_MANIFEST } = require('../lib/manifest');
+const { readLinks } = require('../lib/links');
 
 function packInstallPath(cwd, packageName) {
   const parts = packageName.split('/');
@@ -13,37 +15,46 @@ function packInstallPath(cwd, packageName) {
 
 async function list({ cwd = process.cwd() } = {}) {
   const lock = readLock(cwd);
-  if (!lock || !lock.resolved || !Object.keys(lock.resolved).length) {
-    console.log('No packages installed.');
-    return;
-  }
-
-  const boot = readBoot(cwd);
-  const packages = Object.entries(lock.resolved);
+  if (lock && lock.resolved && Object.keys(lock.resolved).length) {
+    const boot = readBoot(cwd);
+    const packages = Object.entries(lock.resolved);
 
-  const nameWidth = Math.max(7, ...packages.map(([n]) => n.length));
-  const verWidth = Math.max(7, ...packages.map(([, r]) => r.version.length));
+    const nameWidth = Math.max(7, ...packages.map(([n]) => n.length));
+    const verWidth = Math.max(7, ...packages.map(([, r]) => r.version.length));
 
-  console.log(
-    `${'PACKAGE'.padEnd(nameWidth)}  ${'VERSION'.padEnd(verWidth)}  TYPE      STATUS`
-  );
-
-  for (const [pkgName, resolved] of packages) {
-    const enabled = boot.packs[pkgName]?.enabled !== false ? 'enabled' : 'disabled';
+    console.log(
+      `${'PACKAGE'.padEnd(nameWidth)}  ${'VERSION'.padEnd(verWidth)}  TYPE      STATUS`
+    );
 
-    let type = '';
-    const packManifestPath = path.join(packInstallPath(cwd, pkgName), 'tapestry.yaml');
-    if (fs.existsSync(packManifestPath)) {
-      try {
-        type = readYaml(packManifestPath).type || '';
-      } catch {
-        //
+    for (const [pkgName, resolved] of packages) {
+      const enabled = boot.packs[pkgName]?.enabled !== false ? 'enabled' : 'disabled';
+
+      let type = '';
+      const packManifestPath = path.join(packInstallPath(cwd, pkgName), PACK_MANIFEST);
+      if (fs.existsSync(packManifestPath)) {
+        try {
+          type = readYaml(packManifestPath).type || '';
+        } catch {
+          //
+        }
       }
+
+      console.log(
+        `${pkgName.padEnd(nameWidth)}  ${resolved.version.padEnd(verWidth)}  ${type.padEnd(8)}  ${enabled}`
+      );
     }
+  } else {
+    console.log('No packages installed.');
+  }
 
-    console.log(
-      `${pkgName.padEnd(nameWidth)}  ${resolved.version.padEnd(verWidth)}  ${type.padEnd(8)}  ${enabled}`
-    );
+  const { links } = readLinks(cwd);
+  const linkEntries = Object.entries(links);
+  if (linkEntries.length) {
+    console.log('\nLinked:');
+    for (const [name, absPath] of linkEntries) {
+      const flag = fs.existsSync(absPath) ? '' : '  (MISSING)';
+      console.log(`  ${name} -> ${absPath}${flag}`);
+    }
   }
 }
 

package/src/commands/pack.js

@@ -3,12 +3,13 @@
 const path = require('path');
 const { readYaml } = require('../util/yaml');
 const { buildTarball, computeIntegrity } = require('../lib/tarball-builder');
+const { PACK_MANIFEST } = require('../lib/manifest');
 const { validate } = require('./validate');
 
 async function pack({ cwd = process.cwd() } = {}) {
   validate({ cwd });
 
-  const manifest = readYaml(path.join(cwd, 'tapestry.yaml'));
+  const manifest = readYaml(path.join(cwd, PACK_MANIFEST));
   const shortName = manifest.name.split('/')[1];
   const outputPath = path.join(cwd, `${shortName}-${manifest.version}.tgz`);
 

package/src/commands/publish.js

@@ -8,13 +8,14 @@ const FormData = require('form-data');
 const { readYaml } = require('../util/yaml');
 const { validate } = require('./validate');
 const { buildTarball, computeIntegrity } = require('../lib/tarball-builder');
+const { PACK_MANIFEST } = require('../lib/manifest');
 const { requireToken } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 
 async function publish({ cwd = process.cwd(), registryUrl = DEFAULT_REGISTRY } = {}) {
   validate({ cwd });
 
-  const manifest = readYaml(path.join(cwd, 'tapestry.yaml'));
+  const manifest = readYaml(path.join(cwd, PACK_MANIFEST));
   const token = requireToken();
 
   const shortName = manifest.name.split('/')[1];

package/src/commands/update.js

@@ -9,6 +9,7 @@ const { readLock, writeLock } = require('../lib/lock-file');
 const { fetchTarball, DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { verifyIntegrity, saveTarball, extractTarball } = require('../lib/tarball');
 const { addPackageToBoot } = require('../lib/boot');
+const { PACK_MANIFEST } = require('../lib/manifest');
 
 function packInstallPath(cwd, packageName) {
   const parts = packageName.split('/');
@@ -69,7 +70,7 @@ async function update(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_R
       }
     }
 
-    const packManifest = readYaml(path.join(destDir, 'tapestry.yaml'));
+    const packManifest = readYaml(path.join(destDir, PACK_MANIFEST));
     addPackageToBoot(cwd, packageName, packManifest);
   }
 

package/src/commands/validate.js

@@ -4,11 +4,20 @@ const fs = require('fs');
 const path = require('path');
 const { readYaml } = require('../util/yaml');
 const { validatePackageManifest } = require('../schema/manifest');
+const { PACK_MANIFEST } = require('../lib/manifest');
 
 function validate({ cwd = process.cwd() } = {}) {
-  const manifestPath = path.join(cwd, 'tapestry.yaml');
+  const manifestPath = path.join(cwd, PACK_MANIFEST);
   if (!fs.existsSync(manifestPath)) {
-    throw new Error('No tapestry.yaml found in current directory');
+    const serverPath = path.join(cwd, 'tapestry.yaml');
+    if (fs.existsSync(serverPath)) {
+      throw new Error(
+        `No ${PACK_MANIFEST} found in current directory. ` +
+        `The tapestry.yaml here is a server manifest. ` +
+        `Pack validation requires ${PACK_MANIFEST}.`
+      );
+    }
+    throw new Error(`No ${PACK_MANIFEST} found in current directory`);
   }
 
   const data = readYaml(manifestPath);
@@ -18,7 +27,11 @@ function validate({ cwd = process.cwd() } = {}) {
   if (!result.success) {
     for (const issue of result.error.issues) {
       const fieldPath = issue.path.join('.') || 'root';
-      console.log(`  error: ${fieldPath} - ${issue.message}`);
+      let message = issue.message;
+      if (fieldPath === 'engine' && data.engine && typeof data.engine === 'object') {
+        message += `. engine must be a version constraint string in pack manifests (e.g. '>=0.0.1'). Object format is for server manifests (tapestry.yaml).`;
+      }
+      console.log(`  error: ${fieldPath} - ${message}`);
     }
     throw new Error(`${result.error.issues.length} validation error(s)`);
   }

package/src/lib/engine-manager.js

@@ -7,6 +7,7 @@ const { readYaml } = require('../util/yaml');
 const { writePid, readPid, clearPid } = require('./process-tracker');
 const fetch = require('node-fetch');
 const { DEFAULT_REGISTRY } = require('./registry-client');
+const { dockerLinkMounts, materializeLinks } = require('./links');
 
 const NAMED_CHANNELS = ['nightly', 'stable'];
 
@@ -65,7 +66,7 @@ function dockerEnsureImage(image, version) {
   }
 }
 
-function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network) {
+function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network, linkMounts = []) {
   const containerName = `tapestry-${projectName}`;
   dockerEnsureImage(image, version);
   spawnSync('docker', ['rm', '-f', containerName], { stdio: 'ignore' });
@@ -77,6 +78,7 @@ function dockerStart(projectName, image, version, packsDir, serverYamlPath, data
     '-v', `${packsDir}:/app/packs`,
     '-v', `${serverYamlPath}:/app/server.yaml`,
     '-v', `${dataDir}:/app/data`,
+    ...linkMounts,
   ];
   if (network) {
     args.push('--network', network);
@@ -322,10 +324,12 @@ async function startEngine(cwd) {
   fs.mkdirSync(dataDir, { recursive: true });
   if (config.mode === 'docker') {
     const tag = await resolveDockerTag(config);
-    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network);
+    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network, dockerLinkMounts(cwd));
   } else if (config.mode === 'binary') {
+    materializeLinks(cwd);
     binaryStart(config.version, config.installDir, packsDir, serverYamlPath, cwd);
   } else {
+    materializeLinks(cwd);
     sourceStart(config.installDir, packsDir, serverYamlPath, cwd);
   }
 }

package/src/lib/links.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { readYaml, writeYaml } = require('../util/yaml');
+const { PACK_MANIFEST } = require('./manifest');
+
+const LINKS_FILE = 'tapestry-links.yaml';
+
+function readLinks(cwd) {
+  const p = path.join(cwd, LINKS_FILE);
+  if (!fs.existsSync(p)) {
+    return { version: 1, links: {} };
+  }
+  const data = readYaml(p) || {};
+  return { version: data.version || 1, links: data.links || {} };
+}
+
+function writeLinks(cwd, data) {
+  writeYaml(path.join(cwd, LINKS_FILE), { version: 1, links: data.links || {} });
+}
+
+function addLink(cwd, name, absPath) {
+  const data = readLinks(cwd);
+  data.links[name] = absPath;
+  writeLinks(cwd, data);
+}
+
+function removeLink(cwd, name) {
+  const data = readLinks(cwd);
+  if (!(name in data.links)) {
+    return false;
+  }
+  delete data.links[name];
+  writeLinks(cwd, data);
+  return true;
+}
+
+function readPackManifest(packDir) {
+  let p = path.join(packDir, PACK_MANIFEST);
+  if (!fs.existsSync(p)) {
+    p = path.join(packDir, 'tapestry.yaml');
+  }
+  if (!fs.existsSync(p)) {
+    throw new Error(`${packDir} is not a pack (no pack.yaml or tapestry.yaml)`);
+  }
+  return readYaml(p) || {};
+}
+
+function packLinkPath(cwd, name) {
+  return path.join(cwd, 'packs', ...name.split('/'));
+}
+
+function containerPackTarget(name) {
+  return `/app/packs/${name}`;
+}
+
+function dockerLinkMounts(cwd) {
+  const { links } = readLinks(cwd);
+  const args = [];
+  for (const [name, absPath] of Object.entries(links)) {
+    args.push('-v', `${absPath}:${containerPackTarget(name)}`);
+  }
+  return args;
+}
+
+function lexists(p) {
+  try {
+    fs.lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function symlinkType() {
+  return process.platform === 'win32' ? 'junction' : 'dir';
+}
+
+function materializeLinks(cwd) {
+  const { links } = readLinks(cwd);
+  for (const [name, absPath] of Object.entries(links)) {
+    if (!fs.existsSync(absPath)) {
+      throw new Error(`Linked pack '${name}' points to ${absPath}, which no longer exists. Run 'tapestry unlink ${name}' or restore the path.`);
+    }
+    const linkPath = packLinkPath(cwd, name);
+    if (lexists(linkPath)) {
+      fs.rmSync(linkPath, { recursive: true, force: true });
+    }
+    fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+    fs.symlinkSync(absPath, linkPath, symlinkType());
+  }
+}
+
+function removeMaterializedLink(cwd, name) {
+  const linkPath = packLinkPath(cwd, name);
+  if (lexists(linkPath)) {
+    fs.rmSync(linkPath, { recursive: true, force: true });
+  }
+}
+
+function checkMissingDeps(cwd, manifest) {
+  const deps = (manifest && manifest.dependencies) || {};
+  const { links } = readLinks(cwd);
+  const missing = [];
+  for (const depName of Object.keys(deps)) {
+    const installed = fs.existsSync(packLinkPath(cwd, depName));
+    const linked = depName in links;
+    if (!installed && !linked) {
+      missing.push(depName);
+    }
+  }
+  return missing;
+}
+
+module.exports = {
+  LINKS_FILE, readLinks, writeLinks, addLink, removeLink,
+  readPackManifest, packLinkPath, containerPackTarget, dockerLinkMounts,
+  materializeLinks, removeMaterializedLink, checkMissingDeps,
+};

package/src/lib/manifest.js

@@ -0,0 +1,5 @@
+'use strict';
+
+const PACK_MANIFEST = 'pack.yaml';
+
+module.exports = { PACK_MANIFEST };

package/src/scaffold/templates.js

@@ -404,7 +404,7 @@ see_also: [help, commands]
 
 function generatePackFiles({ scopedName, shortName }) {
   return [
-    { path: 'tapestry.yaml', content: manifestTemplate(scopedName) },
+    { path: 'pack.yaml', content: manifestTemplate(scopedName) },
     { path: 'tags.yml', content: tagsTemplate() },
     { path: 'areas/example-area/area.yaml', content: areaTemplate() },
     { path: 'areas/example-area/rooms/town-square.yaml', content: roomTemplate(shortName) },