Compatibility and release scope
Supported npm behavior, lockfile modes, and platform acceptance limits.
These guides target v0.0.13, published on 2026-10-10. Changes in v0.0.13 describes its release scope. Check tapid --version and the selected command's help before using an example.
Package compatibility
| Area | Published v0.0.13 | Remaining limits |
|---|---|---|
| npm versions | Exact and partial versions, wildcards, comparators, caret, tilde, hyphen and OR ranges, with bounded prerelease handling | Dist-tags such as latest, git and file dependencies are unsupported. |
| Aliases | npm: aliases preserve the actual package identity and local import name during install and replay. | Nested aliases, alias dist-tags and JSR aliases are unsupported. |
| Peers | Registry peers require compatible direct project roots; member peers can use local members or direct roots. | No automatic peer installation, nested provider lookup or full peer placement. |
| Optional dependencies | Selection uses supported OS, CPU and libc metadata. | Full npm failure and platform semantics are incomplete. |
| Overrides | Simple string-valued root overrides for supported transitive dependencies | Nested selectors, alias-valued overrides and conflicting direct overrides are unsupported. |
| Workspaces | All discovered members linked, local member cycles, member registry dependencies and manifest validation on replay | Bounded patterns and protocols; incompatible member ranges for the same registry package fail. |
| Private registries | Explicit HTTPS-origin routing and environment-backed credentials | No implicit .npmrc or credential-helper support; remains a development feature. |
| JSR | Requires explicit HTTPS npm tarball and valid SHA-512 integrity | Live JSR behavior remains unverified. |
| Dependency scripts | Denied by default; exact approvals can build private derived trees on Linux ManagedTree | Preparation hooks, live workspace inputs, cyclic approved graphs and macOS/Windows execution are unsupported. |
See Workspaces and Private registries for configuration. The tagged upstream matrix records the detailed v0.0.13 contract.
Lockfiles and replay
Published v0.0.13 writes ordinary schema-7 locks, schema 8 for supported npm imports, and schema 9 for approved derived outputs. Schema 6 remains readable for registry-only projects. Schema 5 lacks required integrity provenance and needs deliberate regeneration. Older clients can reject newer schemas.
Ordinary tapid install replays a matching lock without metadata resolution. Changed manifests prefer compatible locked selections; tapid update explicitly refreshes the graph. Unsupported or noncanonical locks require a verified backup and deliberate removal before generating a replacement.
tapid lock verify checks structure. tapid install --frozen validates manifests and pinned identities and can download missing source trees from locked HTTPS URLs, checking registry-declared SHA-512 integrity and tree digests. --offline forbids downloads, including when combined with --frozen. Corrupt trees, missing provenance and changed routing fail closed. Frozen replay never executes dependency hooks and requires any approved derived outputs already authenticated in the store.
tapid ci preserves ordinary manifest and lock bytes; npm import uses a separate replay contract. Read Troubleshooting before regenerating a lock.
Execution platforms
Package archive availability is separate from script containment support. Published v0.0.13 includes experimental macOS Restricted, Linux Restricted with targeted Ubuntu validation, and a limited Windows read-only AppContainer backend. Windows writes and network-enabled profiles fail closed. Exact integrated-revision acceptance and broader platform matrices remain incomplete.
Linux ManagedTree and configured resource limits are implemented but exact-commit acceptance remains pending. They require Landlock ABI 3 or newer, seccomp, util-linux unshare, private PID/mount namespaces and writable delegated cgroup v2 with memory, pids, kill and swap controls. Missing prerequisites fail before launch. macOS ManagedTree and resource-limit profiles remain unsupported. Read tapid run and the tagged platform validation record before selecting a profile.
Adoption status
Production support is not currently available. Evaluate an exact release and supported subset in a staging project, preserve your npm lockfile and deployment path, compare application behavior, and rehearse rollback. A successful package install or fixture does not establish application or platform readiness. The public adoption gate defines the evidence needed.
Tapid manages dependencies. Node.js executes Node applications; workerd and Wrangler retain their own development and deployment roles. Native publishing, hosted evidence discovery, accounts and Python support remain future work.