Notes on packages, evidence, and the work around them

The Tapid blog is where we explain product decisions, share progress, and look more closely at the package workflows developers rely on.

Start with the product

Tapid records more than a package name

A package install also involves a version, a registry, an artifact, and the integrity information that connects them. The documentation explains how those pieces fit together in the current client.

Read about package identity
Package recordname @ version
registry origin
artifact integrity
lockfile evidence

What we'll write about

Some posts will stay close to the product. Others will follow the questions that shape it.

  • Package identity

    How names, versions, registries, and artifacts fit together when a lockfile needs to describe exactly what a project will use.

  • Evidence before activation

    What Tapid can check before an install changes a project, and where the current client deliberately stops.

  • Building in public

    Progress notes, tradeoffs, and lessons from building a package tool with a small supported scope.

  • The wider ecosystem

    Research into package workflows, publisher identity, provenance, and the systems that connect them.