Commands

Tapid's current CLI is a small, explicit slice of a JavaScript and TypeScript package manager. The commands below are taken from the current Rust client. The install example is verified against the repository's local consumer fixture on macOS. Registry-wide package management, audit, publishing, and private-registry commands are not part of this client yet.

Available now

tapid init [PATH]

Create a private package.json without overwriting an existing file. The path defaults to the current directory.

tapid manifest validate [PATH]

Validate a selected manifest. The path defaults to package.json.

tapid lock verify

Validate tapid.lock before replay. The current command checks the lockfile at the current directory.

tapid install [OPTIONS]

Install a project through one of the currently supported paths:

  • --offline replays an existing lockfile without network resolution.
  • --frozen selects the same no-network replay path in the current implementation.
  • --project-dir PATH selects the project directory.
  • --store-dir PATH selects another verified store root.
  • --registry-fixture PATH uses a local JSON registry fixture for tests and air-gapped development.
  • --allow-unverified-registry-artifacts is an explicit compatibility escape hatch and cannot be combined with --offline or --frozen.

The fixture path is not a production registry mirror or registry authentication feature.

tapid run <SCRIPT> [-- <ARGS>...]

Run a root package.json script after an explicit install. Tapid runs it from the project directory, prepends the managed node_modules/.bin directory to PATH, forwards arguments after --, and returns the child exit status.

Example:

tapid run --project-dir ./example test -- --runInBand

Root scripts may execute arbitrary project code through the platform shell. The runner is compatibility-oriented process execution, not a sandbox.

Verified local fixture flow

This is the current repository-backed demonstration path. It uses the checked-in fixture generator and a validated lockfile, not a live npm project.

cargo build -p tapid --locked
export GITHUB_ENV="$(mktemp)"
node tests/fixtures/create_consumer_project.js
. "$GITHUB_ENV"
export TAPID_FIXTURE=1
target/debug/tapid install --offline --frozen --project-dir "$TAPID_FIXTURE_PROJECT"
target/debug/tapid run --project-dir "$TAPID_FIXTURE_PROJECT" test -- forwarded 0

The locally observed output was:

Fixture project: /var/folders/.../tapid-consumer-...
Replayed lockfile: 0 package(s)
Verified: node_modules created; dependency lifecycle marker absent.

The fixture also checks argument forwarding, child exit-code propagation, executable metadata, and suppression of the dependency lifecycle marker. The exact temporary directory is machine-specific, so it is abbreviated above.

Not available yet

The current client does not implement tapid add, tapid remove, tapid update, tapid prune, tapid audit, tapid x, workspaces, complete npm lockfile compatibility, private-registry authentication, script approval, or publishing. See supported compatibility and Getting started for the current boundary.

The intended package-facing command is tapid install <package-spec>, for example tapid install is-char. The current parser rejects that positional argument with exit code 2; package resolution is not implemented yet.

Getting started · Package identity · Evidence and policy