# tapid ci

Source: https://tapid.dev/docs/commands/ci

Install exact locked dependencies without resolving versions or rewriting project inputs.

## Status

Available starting with published v0.0.13. This command is absent from v0.0.12. See [Release changes](https://tapid.dev/docs-markdown/development/content.md) for the reviewed source revision.

## Syntax

```text
tapid ci [OPTIONS]
```

```bash
$ tapid ci
$ tapid ci --offline
```

`ci` requires a matching manifest, workspace graph and complete ordinary `tapid.lock`. It installs exact locked versions and edges. Missing source archives can be downloaded from locked HTTPS URLs and checked against SHA-512 integrity and tree digests, without registry metadata lookup or version resolution. Manifest and lockfile bytes remain unchanged.

`--offline` requires every necessary verified tree already in the store. Download URLs remain required even for warm-cache or offline ordinary locks. An explicit readable local registry fixture can supply every URL-less locked identity; integrity and tree digests still apply.

## Prepare a repeatable CI install

Create and review an ordinary lock in a development checkout before CI. Include the root and member manifests, `tapid.lock`, registry routing and any exact hook policy in the job's project inputs. Use the same reviewed CLI release and target context; do not regenerate a rejected lock inside CI.

A cold store works when every source has a pinned artifact URL and valid integrity. Private artifacts also need the selected route's protected credential environment. A cache is an optimization for source packages, not a substitute for lock validation. Locks with approved derived outputs need the matching authenticated store state and policy/toolchain prerequisites; copying a derived package directory alone is insufficient.

Installation does not run tests or builds. Run those separately through authorized [script profiles](https://tapid.dev/docs-markdown/commands/run/content.md) on a supported containment platform, and inspect [transaction outcomes](https://tapid.dev/docs-markdown/troubleshooting/content.md) before retrying a failed install. Imported locks use frozen installation instead of `ci`.

## Options and failures

Use `--project-dir PATH`, `--store-dir PATH` and `--registry-fixture PATH` where needed. Check your installed client's `tapid ci --help` for its exact syntax.

Locks missing artifact URLs need a deliberate `tapid update` using live registry metadata, followed by review. A matching lock can be replayed by ordinary `install`, so it does not necessarily refresh missing download metadata. Unmanaged `node_modules` is rejected. Activation and store publication use the recoverable lifecycle transaction. `ci` never runs dependency hooks; approved derived outputs must already be authenticated in the store.

Imported schema-8 locks are rejected. Use [the import workflow](https://tapid.dev/docs-markdown/commands/import-package-lock/content.md) and `tapid install --frozen` for those locks. Global `--json` currently rejects `ci` before execution. Read the [source contract](https://github.com/LimeTip/tapid/blob/a6e109b65b5835c8bd6e023ca283488bd67512bf/docs/releases/0.0.13.md).