@tapestry-mud/cli 0.6.0 → 0.8.0

package/README.md

@@ -83,7 +83,11 @@ my-game/
 | `tapestry search [query]` | Search the registry by keyword |
 | `tapestry info [pack]` | Show pack metadata from the registry |
 | `tapestry register` | Create a registry account |
-| `tapestry login` | Authenticate with the registry |
+| `tapestry login` | Authenticate with the registry (interactive password login) |
+| `tapestry logout` | Revoke your session and remove `~/.tapestryrc` |
+| `tapestry trust add <scope> <repo>` | Authorize a GitHub repo to publish to a scope via OIDC |
+| `tapestry trust list` | List your trusted publishers |
+| `tapestry trust rm <id>` | Remove a trusted publisher binding |
 | `tapestry change-password` | Change your registry password |
 
 ### Pack Authoring
@@ -140,16 +144,23 @@ tapestry dist-tag set @yourscope/my-pack stable 0.1.0
 
 Players using `tapestry init` with a preset that references your pack will resolve to the tagged version.
 
-### CI Publishing
+### CI Publishing (GitHub Actions, OIDC)
 
-For automated pipelines, use token-based auth:
+`tapestry publish` auto-detects the GitHub Actions OIDC environment and exchanges a short-lived
+id-token for a registry access token — no stored secret, no `tapestry login` step. In your workflow:
+
+```yaml
+permissions:
+  id-token: write   # required for OIDC
+```
+
+Authorize the repo once (scope owner or admin):
 
 ```bash
-tapestry login --token $REGISTRY_CI_TOKEN
-tapestry publish
+tapestry trust add yourscope your-org/your-repo
 ```
 
-The CI token is a JWT issued by the registry bootstrap script. Store it as a secret in your CI environment.
+Then `tapestry publish` in CI just works. There is no `REGISTRY_CI_TOKEN` and no `--token` flag.
 
 ## Registry
 

package/bin/tapestry.js

@@ -11,6 +11,7 @@ const { update } = require('../src/commands/update');
 const { enable } = require('../src/commands/enable');
 const { disable } = require('../src/commands/disable');
 const { login } = require('../src/commands/login');
+const { logout } = require('../src/commands/logout');
 const { register } = require('../src/commands/register');
 const { validate } = require('../src/commands/validate');
 const { pack } = require('../src/commands/pack');
@@ -28,6 +29,8 @@ const { changePassword } = require('../src/commands/change-password');
 const { unpublish } = require('../src/commands/unpublish');
 const { distTagSet, distTagList } = require('../src/commands/dist-tag');
 const { presetSet, presetDelete } = require('../src/commands/preset');
+const { trustAdd, trustList, trustRm } = require('../src/commands/trust');
+const { syncArea } = require('../src/commands/sync-area');
 
 const program = new Command();
 
@@ -53,11 +56,15 @@ program.configureHelp({
       },
       {
         title: 'Account',
-        commands: ['register', 'login', 'change-password'],
+        commands: ['register', 'login', 'logout', 'change-password'],
       },
       {
         title: 'Pack Authoring',
-        commands: ['create', 'validate', 'pack', 'publish', 'unpublish'],
+        commands: ['create', 'validate', 'pack', 'publish', 'unpublish', 'sync-area'],
+      },
+      {
+        title: 'Trusted Publishing',
+        commands: ['trust'],
       },
       {
         title: 'Admin',
@@ -243,11 +250,22 @@ program
 
 program
   .command('login')
-  .description('Authenticate with the registry and store token in ~/.tapestryrc')
-  .option('--token <token>', 'Save a raw token directly (for CI use, skips interactive login)')
-  .action(async (options) => {
+  .description('Authenticate with the registry (interactive password login)')
+  .action(async () => {
+    try {
+      await login();
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+program
+  .command('logout')
+  .description('Revoke your session and remove ~/.tapestryrc')
+  .action(async () => {
     try {
-      await login({}, { token: options.token });
+      await logout();
     } catch (e) {
       console.error(`error: ${e.message}`);
       process.exit(1);
@@ -266,6 +284,47 @@ program
     }
   });
 
+const trustCmd = program.command('trust').description('Manage trusted publishers (OIDC CI publishing)');
+
+trustCmd
+  .command('add <scope> <repo>')
+  .description('Authorize a GitHub repo (owner/name) to publish to a scope via OIDC')
+  .option('--ref <ref>', 'Restrict to a git ref, e.g. refs/heads/master')
+  .option('--environment <env>', 'Restrict to a GitHub Actions environment')
+  .action(async (scope, repo, options) => {
+    try {
+      await trustAdd(scope, repo, { ref: options.ref, environment: options.environment });
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+trustCmd
+  .command('list')
+  .description('List trusted publishers you own (all, if admin)')
+  .option('--scope <scope>', 'Filter by scope')
+  .action(async (options) => {
+    try {
+      await trustList(options.scope);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+trustCmd
+  .command('rm <id>')
+  .description('Remove a trusted publisher binding by id')
+  .action(async (id) => {
+    try {
+      await trustRm(id);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
 program
   .command('validate')
   .description('Validate pack.yaml in the current directory')
@@ -302,6 +361,47 @@ program
     }
   });
 
+function runSyncArea(areaRef, opts) {
+  try {
+    syncArea(areaRef, {
+      cwd: process.cwd(),
+      gameRoot: opts.gameRoot,
+      pack: opts.pack,
+      force: opts.force,
+      keepSidecars: opts.keepSidecars,
+      bump: opts.major ? 'major' : opts.minor ? 'minor' : 'patch',
+    });
+  } catch (e) {
+    console.error(`error: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+program
+  .command('sync-area <areaRef>')
+  .description('Commit a game-root authored area back into its pack (areaRef = namespace:area-id)')
+  .option('--pack <dir>', 'Target pack directory (auto-detected from linked packs by default)')
+  .option('--game-root <path>', 'Game root containing data/ (default: current dir)')
+  .option('--keep-sidecars', 'Copy instead of move (leave the game-root side-cars in place)')
+  .option('--force', 'Overwrite pack files that diverge from the side-car')
+  .option('--minor', 'Bump the pack minor version (default: patch)')
+  .option('--major', 'Bump the pack major version (default: patch)')
+  .action(runSyncArea);
+
+program
+  .command('export-area <areaRef>', { hidden: true })
+  .description('(deprecated) alias for sync-area')
+  .option('--pack <dir>', 'Target pack directory (auto-detected from linked packs by default)')
+  .option('--game-root <path>', 'Game root containing data/ (default: current dir)')
+  .option('--keep-sidecars', 'Copy instead of move (leave the game-root side-cars in place)')
+  .option('--force', 'Overwrite pack files that diverge from the side-car')
+  .option('--minor', 'Bump the pack minor version (default: patch)')
+  .option('--major', 'Bump the pack major version (default: patch)')
+  .action((areaRef, opts) => {
+    console.warn('warning: `export-area` is deprecated; use `sync-area`.');
+    runSyncArea(areaRef, opts);
+  });
+
 program
   .command('search <query>')
   .description('Search the registry by keyword')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapestry-mud/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "CLI for the Tapestry MUD engine",
   "repository": {
     "type": "git",

package/src/commands/change-password.js

@@ -1,12 +1,12 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, askPassword } = require('../util/prompt');
 
 async function changePassword({ registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   const rl = createInterface();
   try {
     const currentPassword = await askPassword(rl, 'Current password: ');

package/src/commands/dist-tag.js

@@ -1,10 +1,10 @@
 'use strict';
 
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { patchDistTag, listDistTags, DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 async function distTagSet(packName, tag, version, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await patchDistTag(packName, tag, version, token, registryUrl);
   console.log(`  ${packName}  ${tag} -> ${version}`);
   console.log('Done.');

package/src/commands/install.js

@@ -9,7 +9,7 @@ const { readLock, writeLock, hashDeps } = require('../lib/lock-file');
 const { fetchTarball, DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { verifyIntegrity, saveTarball, extractTarball } = require('../lib/tarball');
 const { addPackageToBoot } = require('../lib/boot');
-const { loadToken } = require('../lib/auth');
+const { loadAccess } = require('../lib/auth');
 const { PACK_MANIFEST } = require('../lib/manifest');
 const { readLinks } = require('../lib/links');
 
@@ -85,7 +85,7 @@ async function install(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_
     throw new Error('No tapestry.yaml found. Run `tapestry init` first.');
   }
 
-  const token = loadToken();
+  const token = await loadAccess();
   const manifest = readYaml(manifestPath);
   let resolved;
 

package/src/commands/link.js

@@ -10,7 +10,7 @@ const { addPackageToBoot, removePackageFromBoot } = require('../lib/boot');
 const { resolve } = require('../lib/semver-resolver');
 const { installResolved, packInstallPath } = require('./install');
 const { readLock, writeLock } = require('../lib/lock-file');
-const { loadToken } = require('../lib/auth');
+const { loadAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 function requireProject(cwd) {
@@ -69,7 +69,7 @@ async function link(targetPath, { cwd = process.cwd(), noInstall = false, regist
 
   let toRollback = [];
   try {
-    const token = loadToken();
+    const token = await loadAccess();
     const resolved = await resolve(needsInstall, registryUrl, token);
 
     // New installs: not on disk yet. Upgrade targets: in needsInstall AND on disk

package/src/commands/login.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { saveToken } = require('../lib/auth');
+const { saveSession, decodeExp } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, ask, askPassword } = require('../util/prompt');
 
@@ -16,12 +16,7 @@ async function promptCredentials() {
   }
 }
 
-async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY, token = null } = {}) {
-  if (token) {
-    saveToken(token);
-    console.log('Token saved.');
-    return;
-  }
+async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY } = {}) {
   if (!email || !password) {
     ({ email, password } = await promptCredentials());
   }
@@ -34,8 +29,8 @@ async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY,
 
   await throwIfError(res, 'Login failed');
 
-  const { token: authToken } = await res.json();
-  saveToken(authToken);
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry: registryUrl, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
   console.log('Logged in.');
 }
 

package/src/commands/logout.js

@@ -0,0 +1,19 @@
+'use strict';
+
+const { readSession, clearSession, DEFAULT_REGISTRY } = require('../lib/auth');
+const { postLogout } = require('../lib/registry-client');
+
+async function logout() {
+  const s = readSession();
+  if (s && s.refresh) {
+    try {
+      await postLogout(s.refresh, s.registry || DEFAULT_REGISTRY);
+    } catch {
+      // Best-effort server revoke; always clear the local session below.
+    }
+  }
+  clearSession();
+  console.log('Logged out.');
+}
+
+module.exports = { logout };

package/src/commands/preset.js

@@ -1,17 +1,17 @@
 'use strict';
 
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { patchPreset, deletePreset, DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 async function presetSet(name, version, engineChannel, packs, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await patchPreset(name, { version, engine_channel: engineChannel, packs }, token, registryUrl);
   console.log(`  Updated preset '${name}' to v${version}`);
   console.log('Done.');
 }
 
 async function presetDelete(name, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await deletePreset(name, token, registryUrl);
   console.log(`  Deleted preset '${name}'`);
   console.log('Done.');

package/src/commands/publish.js

@@ -9,14 +9,25 @@ const { readYaml } = require('../util/yaml');
 const { validate } = require('./validate');
 const { buildTarball, computeIntegrity } = require('../lib/tarball-builder');
 const { PACK_MANIFEST } = require('../lib/manifest');
-const { requireToken } = require('../lib/auth');
-const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
+const { requireAccess } = require('../lib/auth');
+const { DEFAULT_REGISTRY, throwIfError, exchangeOIDCForAccess } = require('../lib/registry-client');
+const { detectCI, fetchGitHubIdToken, AUDIENCE } = require('../lib/oidc');
 
 async function publish({ cwd = process.cwd(), registryUrl = DEFAULT_REGISTRY } = {}) {
   validate({ cwd });
 
   const manifest = readYaml(path.join(cwd, PACK_MANIFEST));
-  const token = requireToken();
+
+  const scope = manifest.name.match(/^@([^/]+)\//)[1];
+  const ciMode = detectCI();
+  let token;
+  if (ciMode) {
+    console.log('Detected GitHub Actions OIDC environment — exchanging id-token...');
+    const idToken = await fetchGitHubIdToken(AUDIENCE);
+    token = await exchangeOIDCForAccess(scope, idToken, registryUrl);
+  } else {
+    token = await requireAccess();
+  }
 
   const shortName = manifest.name.split('/')[1];
   const tmpPath = path.join(
@@ -37,6 +48,10 @@ async function publish({ cwd = process.cwd(), registryUrl = DEFAULT_REGISTRY } =
     });
     form.append('metadata', JSON.stringify({ ...manifest, integrity }));
 
+    if (ciMode) {
+      form.append('tag', 'stable');
+    }
+
     const res = await fetch(`${registryUrl}/v1/publish`, {
       method: 'POST',
       headers: {

package/src/commands/register.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { saveToken } = require('../lib/auth');
+const { saveSession, decodeExp } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, ask, askPassword } = require('../util/prompt');
 
@@ -30,8 +30,8 @@ async function register({ handle, email, password } = {}, { registryUrl = DEFAUL
 
   await throwIfError(res, 'Registration failed');
 
-  const { token } = await res.json();
-  saveToken(token);
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry: registryUrl, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
   console.log(`Registered as ${handle}. Logged in.`);
 }
 

package/src/commands/sync-area.js

@@ -0,0 +1,156 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { readYaml, writeYaml } = require('../util/yaml');
+const { readLinks } = require('../lib/links');
+const { ensureContentGlobs, bumpVersion } = require('../lib/pack-manifest');
+const { isRepo, commitAll } = require('../lib/git');
+
+// "@legends/forgotten" -> "legends-forgotten" (mirrors engine PackLoader.PackNamespace)
+function packNamespace(name) {
+  if (name.indexOf('/') === -1) {
+    return name;
+  }
+  return name.replace(/^@/, '').split('/').join('-');
+}
+
+function detectPackDir(cwd, namespace, explicitPack) {
+  if (explicitPack) {
+    return path.isAbsolute(explicitPack) ? explicitPack : path.join(cwd, explicitPack);
+  }
+  const { links } = readLinks(cwd);
+  const matches = [];
+  for (const [name, dir] of Object.entries(links)) {
+    let derivedNs = namespace;
+    try {
+      const manifest = readYaml(path.join(dir, 'pack.yaml')) || {};
+      derivedNs = packNamespace(manifest.name || name);
+    } catch (e) {
+      derivedNs = packNamespace(name);
+    }
+    if (derivedNs === namespace) {
+      matches.push(dir);
+    }
+  }
+  if (matches.length === 1) {
+    return matches[0];
+  }
+  if (matches.length === 0) {
+    throw new Error(`Could not auto-detect a pack for namespace '${namespace}'. Pass --pack <dir>.`);
+  }
+  throw new Error(`Multiple linked packs match namespace '${namespace}'. Pass --pack <dir>.`);
+}
+
+function syncArea(areaRef, options) {
+  options = options || {};
+  const cwd = options.cwd || process.cwd();
+  const gameRoot = options.gameRoot || cwd;
+  const force = !!options.force;
+  const bumpLevel = options.bump || 'patch';
+  const keepSidecars = !!options.keepSidecars;
+
+  const colon = areaRef.indexOf(':');
+  if (colon < 1) {
+    throw new Error('Usage: sync-area <namespace:area-id> [--pack <dir>]');
+  }
+  const namespace = areaRef.slice(0, colon);
+  const area = areaRef.slice(colon + 1);
+
+  const sideCarRooms = path.join(gameRoot, 'data', 'areas', area, 'rooms');
+  if (!fs.existsSync(sideCarRooms)) {
+    throw new Error(`No authored rooms found for area '${area}' at ${sideCarRooms}`);
+  }
+  const files = fs.readdirSync(sideCarRooms).filter((f) => f.endsWith('.yaml'));
+  if (files.length === 0) {
+    throw new Error(`No authored rooms found for area '${area}'`);
+  }
+
+  const packDir = detectPackDir(cwd, namespace, options.pack);
+
+  const destManifestPath = path.join(packDir, 'pack.yaml');
+  if (!fs.existsSync(destManifestPath)) {
+    throw new Error(`No pack.yaml found in ${packDir}. sync-area targets an existing pack; pass --pack <dir> pointing at one.`);
+  }
+  const destManifest = readYaml(destManifestPath) || {};
+  if (!destManifest.name) {
+    throw new Error(`pack.yaml in ${packDir} has no 'name' field.`);
+  }
+  const destNamespace = packNamespace(destManifest.name);
+  if (destNamespace !== namespace) {
+    throw new Error(
+      `Pack namespace '${destNamespace}' does not match area namespace '${namespace}'. ` +
+      'sync-area only commits an area back into its own pack; use link (or a future migrate) for cross-pack moves.'
+    );
+  }
+
+  const targetRooms = path.join(packDir, 'areas', area, 'rooms');
+  fs.mkdirSync(targetRooms, { recursive: true });
+
+  const sideCarAreaYaml = path.join(gameRoot, 'data', 'areas', area, 'area.yaml');
+  const targetAreaYaml = path.join(packDir, 'areas', area, 'area.yaml');
+  if (fs.existsSync(sideCarAreaYaml)) {
+    // Authored area.yaml already carries the full `area:` envelope (Spec A) — copy it home.
+    writeYaml(targetAreaYaml, readYaml(sideCarAreaYaml));
+  } else if (!fs.existsSync(targetAreaYaml)) {
+    // No authored or pack area.yaml — synthesize a minimal valid envelope so it strict-boots.
+    writeYaml(targetAreaYaml, {
+      area: { id: area, name: area, level_range: [1, 99], reset_interval: 300 },
+    });
+  }
+
+  let written = 0;
+  for (const file of files) {
+    const src = path.join(sideCarRooms, file);
+    const dest = path.join(targetRooms, file);
+    const incoming = readYaml(src);
+    if (fs.existsSync(dest) && !force) {
+      const existing = readYaml(dest);
+      if (JSON.stringify(existing) !== JSON.stringify(incoming)) {
+        throw new Error(
+          `Pack file ${dest} diverges from the side-car. Review the diff and re-run with --force to overwrite.`);
+      }
+    }
+    writeYaml(dest, incoming);
+    written++;
+  }
+
+  ensureContentGlobs(packDir);
+
+  const { old, new: next } = bumpVersion(packDir, bumpLevel);
+  let committed = false;
+  if (isRepo(packDir)) {
+    commitAll(packDir, `content(${area}): sync authored edits, bump ${old} -> ${next}`);
+    committed = true;
+  } else {
+    console.warn(`warn: ${packDir} is not a git repo; bumped to ${next} but did not commit.`);
+  }
+
+  // Move = delete the game-root side-cars now that the content is durably in the pack.
+  // Runs after the write/commit above. In the non-git fallback the content is written
+  // (not committed); deletion is still correct because the pack dir holds the files.
+  if (!keepSidecars) {
+    const areaSideCarDir = path.join(gameRoot, 'data', 'areas', area);
+    for (const file of files) {
+      fs.rmSync(path.join(sideCarRooms, file));
+    }
+    if (fs.existsSync(sideCarRooms) && fs.readdirSync(sideCarRooms).length === 0) {
+      fs.rmdirSync(sideCarRooms);
+    }
+    const sideCarAreaYamlToDelete = path.join(areaSideCarDir, 'area.yaml');
+    if (fs.existsSync(sideCarAreaYamlToDelete)) {
+      fs.rmSync(sideCarAreaYamlToDelete);
+    }
+    if (fs.existsSync(areaSideCarDir) && fs.readdirSync(areaSideCarDir).length === 0) {
+      fs.rmdirSync(areaSideCarDir);
+    }
+  }
+
+  console.log(`Synced ${written} room(s) for area '${area}' into ${packDir} (v${old} -> v${next}).`);
+  if (committed) {
+    console.log('To publish + deploy, push the pack repo:');
+    console.log(`  cd ${packDir} && git push`);
+  }
+}
+
+module.exports = { syncArea, exportArea: syncArea, packNamespace, detectPackDir };

package/src/commands/trust.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const { requireAccess, readSession, DEFAULT_REGISTRY } = require('../lib/auth');
+const {
+  createTrustedPublisher, listTrustedPublishers, deleteTrustedPublisher,
+} = require('../lib/registry-client');
+
+function registryUrl() {
+  const s = readSession();
+  return (s && s.registry) || DEFAULT_REGISTRY;
+}
+
+async function trustAdd(scope, repo, { ref, environment } = {}) {
+  const token = await requireAccess();
+  const body = { scope, repo };
+  if (ref) { body.ref = ref; }
+  if (environment) { body.environment = environment; }
+  const row = await createTrustedPublisher(body, token, registryUrl());
+  console.log(`Trusted publisher #${row.id}: @${row.scope} <- ${row.repo}`);
+}
+
+async function trustList(scope) {
+  const token = await requireAccess();
+  const rows = await listTrustedPublishers(scope, token, registryUrl());
+  if (!rows.length) {
+    console.log('No trusted publishers.');
+    return;
+  }
+  for (const r of rows) {
+    const extra = [r.ref ? `ref=${r.ref}` : null, r.environment ? `env=${r.environment}` : null]
+      .filter(Boolean).join(' ');
+    console.log(`#${r.id}  @${r.scope} <- ${r.repo}${extra ? `  (${extra})` : ''}`);
+  }
+}
+
+async function trustRm(id) {
+  const token = await requireAccess();
+  await deleteTrustedPublisher(id, token, registryUrl());
+  console.log(`Removed trusted publisher #${id}.`);
+}
+
+module.exports = { trustAdd, trustList, trustRm };

package/src/commands/unpublish.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { createInterface, ask } = require('../util/prompt');
 
@@ -16,7 +16,7 @@ function parsePackageArg(arg) {
 }
 
 async function unpublish(packageArg, { force = false, registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   const { pkg, version } = parsePackageArg(packageArg);
 
   if (!/^@[a-z0-9-]+\/[a-z0-9-]+$/.test(pkg)) {

package/src/commands/update.js

@@ -53,7 +53,14 @@ async function update(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_R
 
     const destDir = packInstallPath(cwd, packageName);
     if (fs.existsSync(destDir)) {
-      fs.rmSync(destDir, { recursive: true });
+      try {
+        fs.rmSync(destDir, { recursive: true });
+      } catch (e) {
+        throw new Error(
+          `could not replace ${packageName} at ${destDir}: ${e.message}. ` +
+          `The user running tapestry may not own the packs directory.`
+        );
+      }
     }
 
     const safeId = packageName.replace('@', '').replace('/', '-');

package/src/lib/auth.js

@@ -4,31 +4,81 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const yaml = require('js-yaml');
+const fetch = require('node-fetch');
 
 const RC_PATH = path.join(os.homedir(), '.tapestryrc');
+const DEFAULT_REGISTRY = process.env.TAPESTRY_REGISTRY || 'https://registry.tapestryengine.com';
+const REFRESH_SKEW_SECONDS = 60; // refresh slightly before actual expiry
 
-function loadToken() {
+function readSession() {
   if (!fs.existsSync(RC_PATH)) {
     return null;
   }
   try {
-    const data = yaml.load(fs.readFileSync(RC_PATH, 'utf8'));
-    return data?.token ?? null;
+    return yaml.load(fs.readFileSync(RC_PATH, 'utf8')) || null;
   } catch {
     return null;
   }
 }
 
-function saveToken(token) {
-  fs.writeFileSync(RC_PATH, yaml.dump({ token }, { lineWidth: -1 }), { mode: 0o600 });
+function saveSession({ registry, access, access_exp, refresh }) {
+  fs.writeFileSync(
+    RC_PATH,
+    yaml.dump({ registry, access, access_exp, refresh }, { lineWidth: -1 }),
+    { mode: 0o600 }
+  );
 }
 
-function requireToken() {
-  const token = loadToken();
-  if (!token) {
+function clearSession() {
+  if (fs.existsSync(RC_PATH)) {
+    fs.unlinkSync(RC_PATH);
+  }
+}
+
+function decodeExp(jwtString) {
+  try {
+    const payload = JSON.parse(Buffer.from(jwtString.split('.')[1], 'base64url').toString('utf8'));
+    return typeof payload.exp === 'number' ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+
+async function loadAccess() {
+  const s = readSession();
+  if (!s || !s.access || !s.refresh) {
+    return null; // absent, or legacy token-only rc
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof s.access_exp === 'number' && now < s.access_exp - REFRESH_SKEW_SECONDS) {
+    return s.access;
+  }
+  // Access expired (or near it): silently refresh.
+  const registry = s.registry || DEFAULT_REGISTRY;
+  const res = await fetch(`${registry}/v1/auth/refresh`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ refresh_token: s.refresh }),
+  });
+  if (!res.ok) {
+    clearSession();
+    return null;
+  }
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
+  return access_token;
+}
+
+async function requireAccess() {
+  const access = await loadAccess();
+  if (!access) {
     throw new Error('Not logged in. Run: tapestry login');
   }
-  return token;
+  return access;
 }
 
-module.exports = { RC_PATH, loadToken, saveToken, requireToken };
+module.exports = {
+  RC_PATH, DEFAULT_REGISTRY,
+  readSession, saveSession, clearSession, decodeExp,
+  loadAccess, requireAccess,
+};

package/src/lib/engine-manager.js

@@ -66,7 +66,7 @@ function dockerEnsureImage(image, version) {
   }
 }
 
-function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network, linkMounts = []) {
+function dockerStart(projectName, image, version, packsDir, serverYamlPath, dataDir, network, linkMounts = [], envFile = null) {
   const containerName = `tapestry-${projectName}`;
   dockerEnsureImage(image, version);
   spawnSync('docker', ['rm', '-f', containerName], { stdio: 'ignore' });
@@ -80,6 +80,9 @@ function dockerStart(projectName, image, version, packsDir, serverYamlPath, data
     '-v', `${dataDir}:/app/data`,
     ...linkMounts,
   ];
+  if (envFile) {
+    args.push('--env-file', envFile);
+  }
   if (network) {
     args.push('--network', network);
   }
@@ -268,6 +271,7 @@ function readEngineConfig(cwd) {
     mode: engine.mode,
     image: engine.image || DEFAULT_IMAGE,
     network: engine.network || null,
+    envFile: engine.env_file || null,
     installDir: path.join(cwd, '.tapestry-engine'),
     projectName: (manifest.name || 'tapestry').toLowerCase().replace(/[^a-z0-9-]+/g, '-'),
   };
@@ -324,7 +328,17 @@ async function startEngine(cwd) {
   fs.mkdirSync(dataDir, { recursive: true });
   if (config.mode === 'docker') {
     const tag = await resolveDockerTag(config);
-    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network, dockerLinkMounts(cwd));
+    let envFile = null;
+    if (config.envFile) {
+      envFile = path.resolve(cwd, config.envFile);
+      if (!fs.existsSync(envFile)) {
+        throw new Error(
+          `engine.env_file '${config.envFile}' not found at ${envFile}. ` +
+          'The file must exist on the host running tapestry start.'
+        );
+      }
+    }
+    dockerStart(config.projectName, config.image, tag, packsDir, serverYamlPath, dataDir, config.network, dockerLinkMounts(cwd), envFile);
   } else if (config.mode === 'binary') {
     materializeLinks(cwd);
     binaryStart(config.version, config.installDir, packsDir, serverYamlPath, cwd);

package/src/lib/git.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+
+function isRepo(dir) {
+  const res = spawnSync('git', ['-C', dir, 'rev-parse', '--is-inside-work-tree'], { stdio: 'ignore' });
+  return res.status === 0;
+}
+
+// Stage everything in dir and commit. Throws on failure.
+function commitAll(dir, message) {
+  const add = spawnSync('git', ['-C', dir, 'add', '-A'], { stdio: 'ignore' });
+  if (add.status !== 0) {
+    throw new Error(`git add failed in ${dir}`);
+  }
+  const commit = spawnSync('git', ['-C', dir, 'commit', '-m', message], { stdio: 'ignore' });
+  if (commit.status !== 0) {
+    throw new Error(`git commit failed in ${dir}`);
+  }
+}
+
+module.exports = { isRepo, commitAll };

package/src/lib/oidc.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const fetch = require('node-fetch');
+
+const AUDIENCE = 'https://registry.tapestryengine.com';
+
+function detectCI() {
+  return !!(process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+}
+
+async function fetchGitHubIdToken(audience = AUDIENCE) {
+  const base = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const reqToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  const url = `${base}&audience=${encodeURIComponent(audience)}`;
+  const res = await fetch(url, { headers: { Authorization: `Bearer ${reqToken}` } });
+  if (!res.ok) {
+    throw new Error(`failed to fetch GitHub OIDC id-token (HTTP ${res.status})`);
+  }
+  const { value } = await res.json();
+  if (!value) {
+    throw new Error('GitHub OIDC response had no token value');
+  }
+  return value;
+}
+
+module.exports = { detectCI, fetchGitHubIdToken, AUDIENCE };

package/src/lib/pack-manifest.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const path = require('path');
+const semver = require('semver');
+const { readYaml, writeYaml } = require('../util/yaml');
+
+const CONTENT_GLOBS = {
+  area_definitions: 'areas/**/area.yaml',
+  rooms: 'areas/**/rooms/*.yaml',
+};
+
+// Additively ensure the pack manifest declares the given content globs.
+// Returns the list of keys that were added (empty if no change).
+function ensureContentGlobs(packDir, globs = CONTENT_GLOBS) {
+  const manifestPath = path.join(packDir, 'pack.yaml');
+  const manifest = readYaml(manifestPath) || {};
+  if (!manifest.content || typeof manifest.content !== 'object') {
+    manifest.content = {};
+  }
+  const added = [];
+  for (const [key, value] of Object.entries(globs)) {
+    if (!(key in manifest.content)) {
+      manifest.content[key] = value;
+      added.push(key);
+    }
+  }
+  if (added.length > 0) {
+    writeYaml(manifestPath, manifest);
+  }
+  return added;
+}
+
+// Bump the pack version (patch|minor|major). Returns { old, new }.
+function bumpVersion(packDir, level = 'patch') {
+  const manifestPath = path.join(packDir, 'pack.yaml');
+  const manifest = readYaml(manifestPath) || {};
+  const old = manifest.version;
+  if (!old || !semver.valid(old)) {
+    throw new Error(`pack.yaml has no valid semver version (found: ${old}). Cannot bump.`);
+  }
+  const next = semver.inc(old, level);
+  if (!next) {
+    throw new Error(`Invalid bump level '${level}'. Expected patch, minor, or major.`);
+  }
+  manifest.version = next;
+  writeYaml(manifestPath, manifest);
+  return { old, new: next };
+}
+
+module.exports = { ensureContentGlobs, bumpVersion, CONTENT_GLOBS };

package/src/lib/registry-client.js

@@ -128,7 +128,59 @@ async function deletePreset(name, token, registryUrl = DEFAULT_REGISTRY) {
   return res.json();
 }
 
+async function postLogout(refreshToken, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/auth/logout`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ refresh_token: refreshToken }),
+  });
+  await throwIfError(res, 'Logout failed');
+  return res.json();
+}
+
+async function createTrustedPublisher(body, token, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  });
+  await throwIfError(res, 'Failed to create trusted publisher');
+  return res.json();
+}
+
+async function listTrustedPublishers(scope, token, registryUrl = DEFAULT_REGISTRY) {
+  const q = scope ? `?scope=${encodeURIComponent(scope)}` : '';
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers${q}`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  await throwIfError(res, 'Failed to list trusted publishers');
+  return res.json();
+}
+
+async function deleteTrustedPublisher(id, token, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers/${id}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  await throwIfError(res, 'Failed to delete trusted publisher');
+  return res.json();
+}
+
+async function exchangeOIDCForAccess(scope, idToken, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${idToken}` },
+    body: JSON.stringify({ scope }),
+  });
+  await throwIfError(res, 'OIDC token exchange failed');
+  const { access_token } = await res.json();
+  return access_token;
+}
+
 module.exports = {
   fetchPackageMetadata, fetchTarball, throwIfError, DEFAULT_REGISTRY,
   fetchPreset, fetchPresetList, patchDistTag, listDistTags, patchPreset, deletePreset,
+  postLogout,
+  createTrustedPublisher, listTrustedPublishers, deleteTrustedPublisher,
+  exchangeOIDCForAccess,
 };

package/src/scaffold/templates.js

@@ -7,9 +7,7 @@ version: "0.1.0"
 type: "module"        # core | module | world
 display_name: "TODO: Human-readable name"
 description: "TODO: One-line description for registry search"
-author:
-  name: "TODO: Your Name"
-  handle: "TODO: your-registry-handle"
+author: "TODO: Your Name"
 license: "MIT"
 
 # Packs default to public. Add \`private: true\` to restrict access to your
@@ -39,7 +37,7 @@ tags: "tags.yml"
 
 # Glob patterns -- the engine uses these to find your content
 content:
-  areas: "areas/**/area.yaml"
+  area_definitions: "areas/**/area.yaml"
   rooms: "areas/**/rooms/*.yaml"
   items: "areas/**/items/*.yaml"
   mobs: "areas/**/mobs/*.yaml"

package/src/schema/manifest.js

@@ -10,13 +10,7 @@ const PackageManifestSchema = z.object({
   type: z.enum(['core', 'module', 'world']),
   display_name: z.string().min(1),
   description: z.string().min(1),
-  author: z.union([
-    z.string().min(1),
-    z.object({
-      name: z.string().min(1),
-      handle: z.string().min(1),
-    }),
-  ]),
+  author: z.string().min(1),
   license: z.string().min(1),
   engine: z.string().min(1),
   validation: z.enum(['strict', 'lenient']),
@@ -52,6 +46,8 @@ const ProjectManifestSchema = z.object({
       version: z.string().min(1),
       mode: z.enum(['docker', 'binary', 'source']),
       image: z.string().optional(),
+      network: z.string().optional(),
+      env_file: z.string().optional(),
     }),
   ]),
   dependencies: z.record(z.string()).optional(),