@tapestry-mud/cli 0.4.0 → 0.6.0

package/SECURITY.md

@@ -0,0 +1,93 @@
+# Security Policy
+
+We take the security of Tapestry and its surrounding tooling seriously. This
+document explains how to report a vulnerability and what we do to keep the
+project and its supply chain safe.
+
+## Reporting a Vulnerability
+
+**Please do not open a public issue or pull request for security problems.**
+Public reports tip off attackers before a fix is available.
+
+Instead, report privately through GitHub:
+
+1. Go to this repository's **Security** tab.
+2. Click **Report a vulnerability** (GitHub Private Vulnerability Reporting).
+3. Describe the issue, the affected version or commit, and steps to reproduce.
+
+If you can include a proof of concept, impact assessment, or suggested fix, that
+helps us triage faster — but it isn't required to file a report.
+
+### What to expect
+
+- **A best-effort acknowledgement within 72 hours** of your report.
+- An assessment and, where confirmed, a plan and rough timeline for a fix.
+- **Coordinated disclosure:** we develop and release the fix before publishing
+  details, then credit you in the advisory unless you'd prefer to remain
+  anonymous.
+
+This is a small, fast-moving project, so timelines are best-effort — but we will
+keep you informed.
+
+## Supported Versions
+
+Tapestry is pre-1.0 and moves quickly. Security fixes are applied to the latest
+release and the `master` branch only.
+
+| Version            | Supported          |
+| ------------------ | ------------------ |
+| Latest release     | :white_check_mark: |
+| `master` (default) | :white_check_mark: |
+| Older releases     | :x:                |
+
+If you're running an older tagged release, upgrade to the latest before
+reporting — the issue may already be fixed.
+
+## How We Protect the Supply Chain
+
+Supply-chain attacks (compromised dependencies, malicious package updates,
+hijacked CI) are a primary threat for any project that publishes artifacts. Our
+standing measures:
+
+- **Exact-pinned dependencies.** Every dependency is pinned to an exact version
+  — no `^` or `~` ranges — so a malicious upstream release can't be pulled in
+  silently by a version range.
+- **Install cooldown for new packages.** Package installs enforce a minimum
+  release age, so freshly published versions are not installed immediately. This
+  blunts worm-style compromises that rely on rapid propagation in the hours
+  after a malicious release.
+- **CI actions pinned to commit SHAs.** GitHub Actions are referenced by full
+  commit SHA rather than mutable tags, so a retagged or hijacked action can't
+  alter our builds.
+- **Least-privilege CI.** Workflows declare scoped `permissions:` blocks and use
+  short-lived, narrowly scoped credentials — the built-in `GITHUB_TOKEN`,
+  OpenID Connect (OIDC) tokens, and scoped GitHub App tokens — instead of
+  long-lived personal access tokens or stored secrets.
+- **Protected default branch.** Changes to `master` require a pull request, at
+  least one review, and passing status checks before merge.
+
+## For Contributors and Pack Authors
+
+- **Don't introduce unpinned dependencies.** Match the existing exact-version
+  pinning. PRs that add `^`/`~` ranges will be asked to pin.
+- **Report suspicious dependency behavior.** If a dependency starts doing
+  something unexpected — unfamiliar network calls, new lifecycle scripts,
+  surprising postinstall steps — report it via the process above.
+- **Treat third-party content packs as untrusted.** Packs execute JavaScript
+  (via Jint) inside the engine. Only run packs you trust, and review pack
+  scripts before loading them into a server you care about.
+
+## Scope
+
+**In scope:** the Tapestry engine, registry, CLI, web client, and the official
+content-pack tooling maintained under the `tapestry-mud` organization.
+
+**Out of scope:**
+
+- Misconfiguration of your own self-hosted deployment (firewall rules, exposed
+  admin ports, weak operator passwords, etc.).
+- Third-party or community content packs not authored by this project.
+- Vulnerabilities in upstream dependencies — report those upstream, though we
+  appreciate a heads-up so we can pin around them.
+
+Thank you for helping keep Tapestry and its users safe.

package/bin/tapestry.js

@@ -18,6 +18,7 @@ const { publish } = require('../src/commands/publish');
 const { search } = require('../src/commands/search');
 const { info } = require('../src/commands/info');
 const { list } = require('../src/commands/list');
+const { link, unlink, linkList } = require('../src/commands/link');
 const { outdated } = require('../src/commands/outdated');
 const { engineInstall, engineUpdate, engineInfo } = require('../src/commands/engine');
 const { engineVersions } = require('../src/commands/engine-versions');
@@ -26,7 +27,7 @@ const { stopCmd } = require('../src/commands/stop');
 const { changePassword } = require('../src/commands/change-password');
 const { unpublish } = require('../src/commands/unpublish');
 const { distTagSet, distTagList } = require('../src/commands/dist-tag');
-const { presetSet } = require('../src/commands/preset');
+const { presetSet, presetDelete } = require('../src/commands/preset');
 
 const program = new Command();
 
@@ -40,7 +41,7 @@ program.configureHelp({
     const groups = [
       {
         title: 'Pack Management',
-        commands: ['uninstall', 'update', 'list', 'enable', 'disable', 'outdated'],
+        commands: ['uninstall', 'update', 'list', 'enable', 'disable', 'outdated', 'link', 'unlink'],
       },
       {
         title: 'Engine',
@@ -168,6 +169,18 @@ presetCmd
     }
   });
 
+presetCmd
+  .command('delete <name>')
+  .description('Delete a preset from the registry')
+  .action(async (name) => {
+    try {
+      await presetDelete(name);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
 program
   .command('install [package]')
   .description('Install a package or all dependencies from tapestry.yaml')
@@ -337,6 +350,36 @@ program
     }
   });
 
+program
+  .command('link [path]')
+  .description('Attach a local pack working copy to this project (use --list to show links)')
+  .option('--list', 'List active links instead of creating one')
+  .option('--skip-install', 'Skip dependency resolution; warn about missing deps instead')
+  .action(async (linkPath, options) => {
+    try {
+      if (options.list || !linkPath) {
+        await linkList();
+      } else {
+        await link(linkPath, { noInstall: !!options.skipInstall });
+      }
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+program
+  .command('unlink <name>')
+  .description('Detach a linked pack and restore the registry copy on next install')
+  .action(async (name) => {
+    try {
+      await unlink(name);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
 const engineCmd = program.command('engine').description('Manage the Tapestry engine');
 
 engineCmd

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@tapestry-mud/cli",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "CLI for the Tapestry MUD engine",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tapestry-mud/tapestry-cli.git"
+  },
   "bin": {
     "tapestry": "./bin/tapestry.js"
   },
@@ -12,16 +16,16 @@
     "access": "public"
   },
   "dependencies": {
-    "commander": "^11.1.0",
-    "form-data": "^4.0.5",
-    "inquirer": "^8.2.6",
-    "js-yaml": "^4.1.0",
-    "node-fetch": "^2.7.0",
-    "semver": "^7.6.2",
-    "tar": "^7.5.15",
-    "zod": "^3.22.4"
+    "commander": "11.1.0",
+    "form-data": "4.0.5",
+    "inquirer": "8.2.7",
+    "js-yaml": "4.1.1",
+    "node-fetch": "2.7.0",
+    "semver": "7.6.2",
+    "tar": "7.5.15",
+    "zod": "3.22.4"
   },
   "devDependencies": {
-    "jest": "^29.7.0"
+    "jest": "29.7.0"
   }
 }

package/src/commands/init.js

@@ -238,7 +238,7 @@ async function init(cwd, { registryUrl = DEFAULT_REGISTRY, yes = false, prompter
   fs.mkdirSync(path.join(cwd, 'packs'), { recursive: true });
   fs.writeFileSync(
     path.join(cwd, '.gitignore'),
-    '# Installed packages (managed by tapestry install)\npacks/\n\n# Engine artifacts (managed by tapestry engine install)\n.tapestry-engine/\n\n# Game data (players, saves)\ndata/\n'
+    '# Installed packages (managed by tapestry install)\npacks/\n\n# Local pack links (managed by tapestry link)\ntapestry-links.yaml\n\n# Engine artifacts (managed by tapestry engine install)\n.tapestry-engine/\n\n# Game data (players, saves)\ndata/\n'
   );
 
   console.log('');

package/src/commands/install.js

@@ -11,6 +11,7 @@ const { verifyIntegrity, saveTarball, extractTarball } = require('../lib/tarball
 const { addPackageToBoot } = require('../lib/boot');
 const { loadToken } = require('../lib/auth');
 const { PACK_MANIFEST } = require('../lib/manifest');
+const { readLinks } = require('../lib/links');
 
 function packInstallPath(cwd, packageName) {
   const parts = packageName.split('/');
@@ -34,7 +35,12 @@ function isLockCurrent(manifestDeps, lock) {
 }
 
 async function installResolved(cwd, resolved, token) {
+  const { links } = readLinks(cwd);
   for (const [packageName, info] of Object.entries(resolved)) {
+    if (packageName in links) {
+      console.log(`  skipping ${packageName} (linked)`);
+      continue;
+    }
     const destDir = packInstallPath(cwd, packageName);
 
     if (fs.existsSync(destDir)) {
@@ -98,13 +104,22 @@ async function install(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_
 
     writeYaml(manifestPath, manifest);
   } else {
+    const { links } = readLinks(cwd);
+    for (const name of Object.keys(links)) {
+      if ((manifest.dependencies || {})[name] !== undefined) {
+        console.log(`  skipping ${name} (linked)`);
+      }
+    }
+    const depsToResolve = Object.fromEntries(
+      Object.entries(manifest.dependencies || {}).filter(([name]) => !(name in links))
+    );
     const lock = readLock(cwd);
-    if (lock && isLockCurrent(manifest.dependencies || {}, lock)) {
+    if (lock && isLockCurrent(depsToResolve, lock)) {
       console.log('Installing from lock file...');
       resolved = lock.resolved;
     } else {
       console.log('Resolving dependencies...');
-      resolved = await resolve(manifest.dependencies || {}, registryUrl, token);
+      resolved = await resolve(depsToResolve, registryUrl, token);
     }
   }
 
@@ -114,4 +129,4 @@ async function install(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_
   console.log('Done.');
 }
 
-module.exports = { install };
+module.exports = { install, installResolved, packInstallPath };

package/src/commands/link.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  readLinks, addLink, removeLink, readPackManifest,
+  removeMaterializedLink, checkMissingDeps, partitionDeps,
+} = require('../lib/links');
+const { addPackageToBoot, removePackageFromBoot } = require('../lib/boot');
+const { resolve } = require('../lib/semver-resolver');
+const { installResolved, packInstallPath } = require('./install');
+const { readLock, writeLock } = require('../lib/lock-file');
+const { loadToken } = require('../lib/auth');
+const { DEFAULT_REGISTRY } = require('../lib/registry-client');
+
+function requireProject(cwd) {
+  if (!fs.existsSync(path.join(cwd, 'tapestry.yaml'))) {
+    throw new Error('No tapestry.yaml found. Run `tapestry init` first.');
+  }
+}
+
+function ensureGitignore(cwd) {
+  const gi = path.join(cwd, '.gitignore');
+  if (!fs.existsSync(gi)) {
+    return;
+  }
+  const body = fs.readFileSync(gi, 'utf8');
+  if (!body.split(/\r?\n/).includes('tapestry-links.yaml')) {
+    fs.appendFileSync(gi, `${body.endsWith('\n') ? '' : '\n'}tapestry-links.yaml\n`);
+  }
+}
+
+async function link(targetPath, { cwd = process.cwd(), noInstall = false, registryUrl = DEFAULT_REGISTRY } = {}) {
+  requireProject(cwd);
+  const absPath = path.resolve(cwd, targetPath);
+  if (!fs.existsSync(absPath)) {
+    throw new Error(`Path not found: ${absPath}`);
+  }
+  const manifest = readPackManifest(absPath);
+  const name = manifest.name;
+  if (!name) {
+    throw new Error(`Pack at ${absPath} has no 'name' in its manifest`);
+  }
+
+  addLink(cwd, name, absPath);
+  addPackageToBoot(cwd, name, manifest);
+  ensureGitignore(cwd);
+
+  // Warn if the pack is marked inactive — fires on all paths
+  if (manifest.active === false) {
+    console.warn(`  warning: ${name} is marked active: false; it will not load until activated`);
+  }
+
+  if (noInstall) {
+    console.log(`linked ${name} -> ${absPath}`);
+    for (const dep of checkMissingDeps(cwd, manifest)) {
+      const range = manifest.dependencies[dep];
+      console.warn(`  warning: missing dependency ${dep} (${range}) -- run: tapestry install ${dep}`);
+    }
+    return;
+  }
+
+  const { needsInstall } = partitionDeps(cwd, manifest);
+
+  if (Object.keys(needsInstall).length === 0) {
+    console.log(`linked ${name} -> ${absPath}`);
+    return;
+  }
+
+  let toRollback = [];
+  try {
+    const token = loadToken();
+    const resolved = await resolve(needsInstall, registryUrl, token);
+
+    // New installs: not on disk yet. Upgrade targets: in needsInstall AND on disk
+    // (installResolved deletes the old dir before downloading; track so rollback removes the boot entry)
+    toRollback = [
+      ...Object.keys(resolved).filter((n) => !fs.existsSync(packInstallPath(cwd, n))),
+      ...Object.keys(needsInstall).filter((n) => fs.existsSync(packInstallPath(cwd, n))),
+    ];
+
+    await installResolved(cwd, resolved, token);
+
+    const existingLock = readLock(cwd);
+    const mergedResolved = Object.assign({}, (existingLock && existingLock.resolved) || {}, resolved);
+    writeLock(cwd, {
+      lockfile_version: 1,
+      ...(existingLock && existingLock.deps_hash ? { deps_hash: existingLock.deps_hash } : {}),
+      resolved: mergedResolved,
+    });
+
+    console.log(`linked ${name} -> ${absPath}`);
+    for (const [pkgName, info] of Object.entries(resolved)) {
+      console.log(`  installed ${pkgName}@${info.version} (dependency of ${name})`);
+    }
+  } catch (err) {
+    removeLink(cwd, name);
+    removePackageFromBoot(cwd, name);
+    for (const pkgName of toRollback) {
+      const installPath = packInstallPath(cwd, pkgName);
+      if (fs.existsSync(installPath)) {
+        fs.rmSync(installPath, { recursive: true });
+      }
+      removePackageFromBoot(cwd, pkgName);
+    }
+    throw new Error(
+      `Cannot resolve dependencies for ${name} — ${err.message}. Use --skip-install to link without dependency resolution.`
+    );
+  }
+}
+
+async function unlink(name, { cwd = process.cwd() } = {}) {
+  requireProject(cwd);
+  if (!removeLink(cwd, name)) {
+    throw new Error(`${name} is not linked`);
+  }
+  removeMaterializedLink(cwd, name);
+  removePackageFromBoot(cwd, name);
+  console.log(`unlinked ${name}`);
+  console.log(`  run 'tapestry install' to restore the registry copy`);
+}
+
+async function linkList({ cwd = process.cwd() } = {}) {
+  const { links } = readLinks(cwd);
+  const entries = Object.entries(links);
+  if (entries.length === 0) {
+    console.log('No linked packs.');
+    return;
+  }
+  for (const [name, absPath] of entries) {
+    const flag = fs.existsSync(absPath) ? '' : '  (MISSING)';
+    console.log(`${name} -> ${absPath}${flag}`);
+  }
+}
+
+module.exports = { link, unlink, linkList };

package/src/commands/list.js

@@ -6,6 +6,7 @@ const { readLock } = require('../lib/lock-file');
 const { readBoot } = require('../lib/boot');
 const { readYaml } = require('../util/yaml');
 const { PACK_MANIFEST } = require('../lib/manifest');
+const { readLinks } = require('../lib/links');
 
 function packInstallPath(cwd, packageName) {
   const parts = packageName.split('/');
@@ -14,37 +15,46 @@ function packInstallPath(cwd, packageName) {
 
 async function list({ cwd = process.cwd() } = {}) {
   const lock = readLock(cwd);
-  if (!lock || !lock.resolved || !Object.keys(lock.resolved).length) {
-    console.log('No packages installed.');
-    return;
-  }
-
-  const boot = readBoot(cwd);
-  const packages = Object.entries(lock.resolved);
+  if (lock && lock.resolved && Object.keys(lock.resolved).length) {
+    const boot = readBoot(cwd);
+    const packages = Object.entries(lock.resolved);
 
-  const nameWidth = Math.max(7, ...packages.map(([n]) => n.length));
-  const verWidth = Math.max(7, ...packages.map(([, r]) => r.version.length));
+    const nameWidth = Math.max(7, ...packages.map(([n]) => n.length));
+    const verWidth = Math.max(7, ...packages.map(([, r]) => r.version.length));
 
-  console.log(
-    `${'PACKAGE'.padEnd(nameWidth)}  ${'VERSION'.padEnd(verWidth)}  TYPE      STATUS`
-  );
-
-  for (const [pkgName, resolved] of packages) {
-    const enabled = boot.packs[pkgName]?.enabled !== false ? 'enabled' : 'disabled';
+    console.log(
+      `${'PACKAGE'.padEnd(nameWidth)}  ${'VERSION'.padEnd(verWidth)}  TYPE      STATUS`
+    );
 
-    let type = '';
-    const packManifestPath = path.join(packInstallPath(cwd, pkgName), PACK_MANIFEST);
-    if (fs.existsSync(packManifestPath)) {
-      try {
-        type = readYaml(packManifestPath).type || '';
-      } catch {
-        //
+    for (const [pkgName, resolved] of packages) {
+      const enabled = boot.packs[pkgName]?.enabled !== false ? 'enabled' : 'disabled';
+
+      let type = '';
+      const packManifestPath = path.join(packInstallPath(cwd, pkgName), PACK_MANIFEST);
+      if (fs.existsSync(packManifestPath)) {
+        try {
+          type = readYaml(packManifestPath).type || '';
+        } catch {
+          //
+        }
       }
+
+      console.log(
+        `${pkgName.padEnd(nameWidth)}  ${resolved.version.padEnd(verWidth)}  ${type.padEnd(8)}  ${enabled}`
+      );
     }
+  } else {
+    console.log('No packages installed.');
+  }
 
-    console.log(
-      `${pkgName.padEnd(nameWidth)}  ${resolved.version.padEnd(verWidth)}  ${type.padEnd(8)}  ${enabled}`
-    );
+  const { links } = readLinks(cwd);
+  const linkEntries = Object.entries(links);
+  if (linkEntries.length) {
+    console.log('\nLinked:');
+    for (const [name, absPath] of linkEntries) {
+      const flag = fs.existsSync(absPath) ? '' : '  (MISSING)';
+      console.log(`  ${name} -> ${absPath}${flag}`);
+    }
   }
 }
 

package/src/commands/preset.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { requireToken } = require('../lib/auth');
-const { patchPreset, DEFAULT_REGISTRY } = require('../lib/registry-client');
+const { patchPreset, deletePreset, DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 async function presetSet(name, version, engineChannel, packs, { registryUrl = DEFAULT_REGISTRY } = {}) {
   const token = requireToken();
@@ -10,4 +10,11 @@ async function presetSet(name, version, engineChannel, packs, { registryUrl = DE
   console.log('Done.');
 }
 
-module.exports = { presetSet };
+async function presetDelete(name, { registryUrl = DEFAULT_REGISTRY } = {}) {
+  const token = requireToken();
+  await deletePreset(name, token, registryUrl);
+  console.log(`  Deleted preset '${name}'`);
+  console.log('Done.');
+}
+
+module.exports = { presetSet, presetDelete };

package/src/lib/engine-manager.js

@@ -7,6 +7,7 @@ const { readYaml } = require('../util/yaml');
 const { writePid, readPid, clearPid } = require('./process-tracker');
 const fetch = require('node-fetch');
 const { DEFAULT_REGISTRY } = require('./registry-client');
+const { dockerLinkMounts, materializeLinks } = require('./links');
 
 const NAMED_CHANNELS = ['nightly', 'stable'];
 
@@ -65,7 +66,7 @@ function dockerEnsureImage(image, version) {
   }
 }
 
-function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network) {
+function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network, linkMounts = []) {
   const containerName = `tapestry-${projectName}`;
   dockerEnsureImage(image, version);
   spawnSync('docker', ['rm', '-f', containerName], { stdio: 'ignore' });
@@ -77,6 +78,7 @@ function dockerStart(projectName, image, version, packsDir, serverYamlPath, data
     '-v', `${packsDir}:/app/packs`,
     '-v', `${serverYamlPath}:/app/server.yaml`,
     '-v', `${dataDir}:/app/data`,
+    ...linkMounts,
   ];
   if (network) {
     args.push('--network', network);
@@ -322,10 +324,12 @@ async function startEngine(cwd) {
   fs.mkdirSync(dataDir, { recursive: true });
   if (config.mode === 'docker') {
     const tag = await resolveDockerTag(config);
-    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network);
+    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network, dockerLinkMounts(cwd));
   } else if (config.mode === 'binary') {
+    materializeLinks(cwd);
     binaryStart(config.version, config.installDir, packsDir, serverYamlPath, cwd);
   } else {
+    materializeLinks(cwd);
     sourceStart(config.installDir, packsDir, serverYamlPath, cwd);
   }
 }

package/src/lib/links.js

@@ -0,0 +1,147 @@
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const semver = require('semver');
+const { readYaml, writeYaml } = require('../util/yaml');
+const { PACK_MANIFEST } = require('./manifest');
+
+const LINKS_FILE = 'tapestry-links.yaml';
+
+function readLinks(cwd) {
+  const p = path.join(cwd, LINKS_FILE);
+  if (!fs.existsSync(p)) {
+    return { version: 1, links: {} };
+  }
+  const data = readYaml(p) || {};
+  return { version: data.version || 1, links: data.links || {} };
+}
+
+function writeLinks(cwd, data) {
+  writeYaml(path.join(cwd, LINKS_FILE), { version: 1, links: data.links || {} });
+}
+
+function addLink(cwd, name, absPath) {
+  const data = readLinks(cwd);
+  data.links[name] = absPath;
+  writeLinks(cwd, data);
+}
+
+function removeLink(cwd, name) {
+  const data = readLinks(cwd);
+  if (!(name in data.links)) {
+    return false;
+  }
+  delete data.links[name];
+  writeLinks(cwd, data);
+  return true;
+}
+
+function readPackManifest(packDir) {
+  let p = path.join(packDir, PACK_MANIFEST);
+  if (!fs.existsSync(p)) {
+    p = path.join(packDir, 'tapestry.yaml');
+  }
+  if (!fs.existsSync(p)) {
+    throw new Error(`${packDir} is not a pack (no pack.yaml or tapestry.yaml)`);
+  }
+  return readYaml(p) || {};
+}
+
+function packLinkPath(cwd, name) {
+  return path.join(cwd, 'packs', ...name.split('/'));
+}
+
+function containerPackTarget(name) {
+  return `/app/packs/${name}`;
+}
+
+function dockerLinkMounts(cwd) {
+  const { links } = readLinks(cwd);
+  const args = [];
+  for (const [name, absPath] of Object.entries(links)) {
+    args.push('-v', `${absPath}:${containerPackTarget(name)}`);
+  }
+  return args;
+}
+
+function lexists(p) {
+  try {
+    fs.lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function symlinkType() {
+  return process.platform === 'win32' ? 'junction' : 'dir';
+}
+
+function materializeLinks(cwd) {
+  const { links } = readLinks(cwd);
+  for (const [name, absPath] of Object.entries(links)) {
+    if (!fs.existsSync(absPath)) {
+      throw new Error(`Linked pack '${name}' points to ${absPath}, which no longer exists. Run 'tapestry unlink ${name}' or restore the path.`);
+    }
+    const linkPath = packLinkPath(cwd, name);
+    if (lexists(linkPath)) {
+      fs.rmSync(linkPath, { recursive: true, force: true });
+    }
+    fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+    fs.symlinkSync(absPath, linkPath, symlinkType());
+  }
+}
+
+function removeMaterializedLink(cwd, name) {
+  const linkPath = packLinkPath(cwd, name);
+  if (lexists(linkPath)) {
+    fs.rmSync(linkPath, { recursive: true, force: true });
+  }
+}
+
+function checkMissingDeps(cwd, manifest) {
+  const deps = (manifest && manifest.dependencies) || {};
+  const { links } = readLinks(cwd);
+  const missing = [];
+  for (const depName of Object.keys(deps)) {
+    const installed = fs.existsSync(packLinkPath(cwd, depName));
+    const linked = depName in links;
+    if (!installed && !linked) {
+      missing.push(depName);
+    }
+  }
+  return missing;
+}
+
+function partitionDeps(cwd, manifest) {
+  const deps = (manifest && manifest.dependencies) || {};
+  const needsInstall = {};
+  if (Object.keys(deps).length === 0) {
+    return { needsInstall };
+  }
+  const { links } = readLinks(cwd);
+  for (const [depName, range] of Object.entries(deps)) {
+    if (depName in links) {
+      continue;
+    }
+    const installPath = packLinkPath(cwd, depName);
+    if (fs.existsSync(installPath)) {
+      const manifestPath = path.join(installPath, PACK_MANIFEST);
+      if (fs.existsSync(manifestPath)) {
+        const installed = readYaml(manifestPath) || {};
+        if (installed.version && semver.satisfies(installed.version, range)) {
+          continue;
+        }
+      }
+    }
+    needsInstall[depName] = range;
+  }
+  return { needsInstall };
+}
+
+module.exports = {
+  LINKS_FILE, readLinks, writeLinks, addLink, removeLink,
+  readPackManifest, packLinkPath, containerPackTarget, dockerLinkMounts,
+  materializeLinks, removeMaterializedLink, checkMissingDeps, partitionDeps,
+};

package/src/lib/registry-client.js

@@ -116,7 +116,19 @@ async function patchPreset(name, payload, token, registryUrl = DEFAULT_REGISTRY)
   return res.json();
 }
 
+async function deletePreset(name, token, registryUrl = DEFAULT_REGISTRY) {
+  const url = `${registryUrl.replace(/\/$/, '')}/v1/admin/presets/${name}`;
+  const res = await fetch(url, {
+    method: 'DELETE',
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+  });
+  await throwIfError(res, `Failed to delete preset '${name}'`);
+  return res.json();
+}
+
 module.exports = {
   fetchPackageMetadata, fetchTarball, throwIfError, DEFAULT_REGISTRY,
-  fetchPreset, fetchPresetList, patchDistTag, listDistTags, patchPreset,
+  fetchPreset, fetchPresetList, patchDistTag, listDistTags, patchPreset, deletePreset,
 };