# tapid import-package-lock

Source: https://tapid.dev/docs/commands/import-package-lock

Import the supported npm lockfile v3 subset offline, then verify pinned artifacts.

## Status

Available starting with published v0.0.13, absent from v0.0.12. This is a one-time migration of the supported registry-only npm lockfile v3 subset.

## Import and verify

Preserve `package.json`, `package-lock.json`, any existing `tapid.lock` and the existing installation before migrating. Use a project without pending Tapid recovery.

```bash
$ tapid import-package-lock ./package-lock.json
$ tapid lock verify
```

Import reads the manifest and npm lock offline. It preserves selected versions, URLs, integrity, supported dependency and peer placements, and optional/platform constraints. It writes a schema-8 Tapid lock without changing the manifest, store or `node_modules`.

The npm root declarations must match the manifest. Older or stale npm locks need a separately reviewed npm refresh. For private packages, configure matching Tapid registry origins before import; the importer does not read npm credentials or substitute registry hosts.

Back up and move the old npm-managed `node_modules` out of the project before activation. Then verify and install pinned artifacts:

```bash
$ tapid install --frozen
$ tapid install --offline --frozen
```

The first frozen install may download exact locked tarballs and record tree verification receipts. It does not resolve versions. Offline replay requires the applicable verified trees already in the store. Ordinary v0.0.13 frozen replay can also fetch missing pinned artifacts, but preserves ordinary lock bytes. Imported locks can gain verification receipts. In v0.0.12, ordinary frozen replay never downloads.

## Supported subset and limits

Canonical HTTPS registry tarballs with one padded SHA-512 integrity value are required. Supported imported graphs can preserve nested duplicate versions, aliases, ancestor peer edges and distinct representable peer contexts. Workspace/link entries, git/file sources, bundled packages, unsupported integrity and unrepresentable placements fail before writing.

Tapid does not reproduce npm's physical hoisting layout. Optional packages follow retained platform constraints; an applicable package's download or verification failure aborts installation. Dependency scripts never run for imported locks, so generated-code or native packages may remain unusable.

`tapid ci` and `outdated` reject imported locks. A plain `tapid install` also preserves an imported graph. `add`, `remove` and `update` return to ordinary resolution, which can change selections and has narrower peer semantics. Keep the npm backup until your actual application and runtime pass comparison checks.

Import failure leaves existing inputs unchanged. Undo a successful import by restoring the saved Tapid lock. After installation, rollback also requires the matching manifest and verified trees, or restoration of the saved npm project. See the [pinned migration contract](https://github.com/LimeTip/tapid/blob/a6e109b65b5835c8bd6e023ca283488bd67512bf/docs/npm-lockfile-import.md) for detailed validation and rollback.