Commands
Tapid commands, their effects, and the supported release scope.
Version scope
These examples target v0.0.13, published on 2026-10-10. Release changes records its reviewed source and implementation limits.
Check your installed binary before choosing a command:
Published commands
| Command | Purpose |
|---|---|
| tapid init | Create a private manifest in an existing directory. |
| tapid manifest validate | Validate a manifest without changing it. |
| tapid lock verify | Check the structure of tapid.lock. |
| tapid install | Resolve dependencies or replay a verified lockfile. i is an alias. |
| tapid run | Launch an explicit Node.js root script under its configured execution policy. |
| tapid upgrade | Verify a release and replace the Tapid executable. Available starting with 0.0.10. |
| tapid add | Add packages to a dependency section and install the resulting graph. |
| tapid remove | Remove declared dependencies and reinstall the remaining graph. |
| tapid update | Resolve the graph again, preserving declared ranges unless --latest is selected. |
| tapid outdated | Compare direct requirements and locked versions with registry versions. |
| tapid prune | Rebuild managed node_modules from the lockfile without network access. |
| tapid license | Print the embedded Apache-2.0 license and attribution offline. Available starting with 0.0.12. |
| tapid ci | Install exact ordinary locked dependencies, fetching missing verified artifacts without resolution. |
| tapid import-package-lock | Import the supported npm lockfile v3 subset offline. |
Global JSON results and approved dependency scripts are available in v0.0.13. Their command coverage and execution prerequisites differ.
Typical project flow
lock verify checks lockfile structure. Offline/frozen installation also checks the root manifest digest and verified store before activation. Neither result proves that dependency code is safe. Dependency lifecycle scripts are denied by default. Exactly approved hooks require supported Linux ManagedTree execution; offline/frozen replay and ci never execute hooks.
Read Getting started for installation and Using Tapid with AI agents for version checks, command effects, and Markdown access. Native publishing, package audits, one-shot execution, and store garbage collection are not exposed commands in this CLI.