# Compatibility and release scope

Source: https://tapid.dev/docs/compatibility

Supported npm behavior, lockfile modes, and platform acceptance limits.

These guides target [v0.0.13](https://github.com/LimeTip/tapid/releases/tag/v0.0.13), published on 2026-10-10. [Changes in v0.0.13](https://tapid.dev/docs-markdown/development/content.md) describes its release scope. Check `tapid --version` and the selected command's help before using an example.

## Package compatibility

| Area                  | Published v0.0.13                                                                                                        | Remaining limits                                                                                              |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- |
| npm versions          | Exact and partial versions, wildcards, comparators, caret, tilde, hyphen and OR ranges, with bounded prerelease handling | Dist-tags such as `latest`, git and file dependencies are unsupported.                                        |
| Aliases               | `npm:` aliases preserve the actual package identity and local import name during install and replay.                     | Nested aliases, alias dist-tags and JSR aliases are unsupported.                                              |
| Peers                 | Registry peers require compatible direct project roots; member peers can use local members or direct roots.              | No automatic peer installation, nested provider lookup or full peer placement.                                |
| Optional dependencies | Selection uses supported OS, CPU and libc metadata.                                                                      | Full npm failure and platform semantics are incomplete.                                                       |
| Overrides             | Simple string-valued root overrides for supported transitive dependencies                                                | Nested selectors, alias-valued overrides and conflicting direct overrides are unsupported.                    |
| Workspaces            | All discovered members linked, local member cycles, member registry dependencies and manifest validation on replay       | Bounded patterns and protocols; incompatible member ranges for the same registry package fail.                |
| Private registries    | Explicit HTTPS-origin routing and environment-backed credentials                                                         | No implicit `.npmrc` or credential-helper support; remains a development feature.                             |
| JSR                   | Requires explicit HTTPS npm tarball and valid SHA-512 integrity                                                          | Live JSR behavior remains unverified.                                                                         |
| Dependency scripts    | Denied by default; exact approvals can build private derived trees on Linux ManagedTree                                  | Preparation hooks, live workspace inputs, cyclic approved graphs and macOS/Windows execution are unsupported. |

See [Workspaces](https://tapid.dev/docs-markdown/workspaces/content.md) and [Private registries](https://tapid.dev/docs-markdown/private-registries/content.md) for configuration. The [tagged upstream matrix](https://github.com/LimeTip/tapid/blob/v0.0.13/docs/compatibility.md) records the detailed v0.0.13 contract.

## Lockfiles and replay

Published v0.0.13 writes ordinary schema-7 locks, schema 8 for supported npm imports, and schema 9 for approved derived outputs. Schema 6 remains readable for registry-only projects. Schema 5 lacks required integrity provenance and needs deliberate regeneration. Older clients can reject newer schemas.

Ordinary `tapid install` replays a matching lock without metadata resolution. Changed manifests prefer compatible locked selections; `tapid update` explicitly refreshes the graph. Unsupported or noncanonical locks require a verified backup and deliberate removal before generating a replacement.

`tapid lock verify` checks structure. `tapid install --frozen` validates manifests and pinned identities and can download missing source trees from locked HTTPS URLs, checking registry-declared SHA-512 integrity and tree digests. `--offline` forbids downloads, including when combined with `--frozen`. Corrupt trees, missing provenance and changed routing fail closed. Frozen replay never executes dependency hooks and requires any approved derived outputs already authenticated in the store.

[tapid ci](https://tapid.dev/docs-markdown/commands/ci/content.md) preserves ordinary manifest and lock bytes; [npm import](https://tapid.dev/docs-markdown/commands/import-package-lock/content.md) uses a separate replay contract. Read [Troubleshooting](https://tapid.dev/docs-markdown/troubleshooting/content.md) before regenerating a lock.

## Execution platforms

Package archive availability is separate from script containment support. Published v0.0.13 includes experimental macOS Restricted, Linux Restricted with targeted Ubuntu validation, and a limited Windows read-only AppContainer backend. Windows writes and network-enabled profiles fail closed. Exact integrated-revision acceptance and broader platform matrices remain incomplete.

Linux ManagedTree and configured resource limits are implemented but exact-commit acceptance remains pending. They require Landlock ABI 3 or newer, seccomp, util-linux `unshare`, private PID/mount namespaces and writable delegated cgroup v2 with memory, pids, kill and swap controls. Missing prerequisites fail before launch. macOS ManagedTree and resource-limit profiles remain unsupported. Read [tapid run](https://tapid.dev/docs-markdown/commands/run/content.md) and the [tagged platform validation record](https://github.com/LimeTip/tapid/blob/v0.0.13/docs/platform-validation.md) before selecting a profile.

## Adoption status

Production support is not currently available. Evaluate an exact release and supported subset in a staging project, preserve your npm lockfile and deployment path, compare application behavior, and rehearse rollback. A successful package install or fixture does not establish application or platform readiness. The public [adoption gate](https://github.com/LimeTip/tapid/blob/v0.0.13/docs/production-adoption.md) defines the evidence needed.

Tapid manages dependencies. Node.js executes Node applications; workerd and Wrangler retain their own development and deployment roles. Native publishing, hosted evidence discovery, accounts and Python support remain future work.