v0.0.12 | tapid

Tapid 0.0.12 was published on October 8, 2026. GitHub is the source for the release notes, installers, checksums, and archives shown here.

Open the release on GitHub

Install Tapid 0.0.12

Download the installer from the version tag, inspect it, and run it with the same explicit version.

macOS and Linux

$ (
$ installer="$(mktemp)" || exit 1
$ trap 'rm -f "$installer"' EXIT HUP INT TERM
$ curl -fsSL https://github.com/LimeTip/tapid/releases/download/v0.0.12/install.sh -o "$installer" || exit 1
$ if command -v less >/dev/null 2>&1; then
$   less "$installer" || exit 1
$ else
$   cat "$installer" || exit 1
$ fi
$ sh "$installer" --version v0.0.12
$ )

Windows PowerShell

$ $installer = Join-Path $env:TEMP "tapid-install.ps1"
$ Invoke-WebRequest https://github.com/LimeTip/tapid/releases/download/v0.0.12/install.ps1 -OutFile $installer
$ Get-Content $installer
$ & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $installer -Version v0.0.12
$ Remove-Item $installer

Release downloads

These links download the native archives directly from the GitHub release. Verify an archive against SHA256SUMS before extracting it manually.

macOS

Arm64 (3.5 MB)
x86-64 (3.7 MB)

Linux

Arm64 (3.7 MB)
x86-64 (3.8 MB)

Windows

Arm64 (3.1 MB)
x86-64 (3.3 MB)

Release notes

Tapid 0.0.12 release notes

Tapid 0.0.12 adds npm workspace links and member operations, clearer install diagnostics, stronger installer replay protection, and Apache-2.0 licensing.

Licensing

License the Tapid CLI and its supporting crates in this repository under Apache-2.0.
Include the full license text in all crate packages.
Add tapid license to print the complete license and LimeTip AB copyright attribution offline, without requiring a project.
Keep contributions under Apache-2.0 with contributors retaining copyright ownership.

npm workspaces

Discover workspace members through supported root declarations and bounded glob patterns. Reject duplicate member names and paths outside the canonical workspace root.
Link local workspace packages for ordinary semver dependencies and workspace:*, workspace:^, and workspace:~. Missing or incompatible local targets fail before mutation, without registry fallback.
Resolve workspace members' registry dependencies and validate member peers against local members or compatible direct root providers.
Support root and selected-member install and lifecycle operations with a root-owned lockfile and managed node_modules activation. prune --workspace replays the workspace-root lockfile without changing the member manifest.
Persist workspace identities, dependency edges, and member manifest digests. Revalidate local members during offline and frozen replay.
Run explicitly selected workspace scripts from the member directory while keeping containment rooted at the workspace.

Workspace support remains bounded. Glob matching does not implement full npm minimatch semantics. Incompatible ranges for the same registry package across members fail instead of producing separate member-specific versions. Nested peer placement and full npm workspace compatibility remain unsupported. See [the compatibility matrix](../compatibility.md#compatibility-matrix).

Install and lifecycle diagnostics

Print categorized diagnostic: codes for install and lifecycle failures, including missing lockfiles, registry credentials, resolution errors, and integrity failures.
Distinguish rollback, committed changes with pending cleanup, and recovery-required failures. Explain when changes have already committed so users do not repeat an operation unnecessarily.
Report contention retry guidance, bound diagnostic messages, and redact HTTP URL credentials, query values, and fragments.

Operational failures continue to exit with code 1. These changes do not introduce a JSON command protocol.

Installer and workspace security

Apply durable release-version and archive-digest checks before installer replacement. Reject downgrades and different executable bytes at the same version, and preserve verified recovery data for interrupted installation.
Prevent historical installers from replacing an existing installation with different bytes or bypassing managed release state. Use tapid upgrade for existing managed installations.
Reject workspace symlink escapes during discovery, validation, and managed-tree handling. Validate selected script working directories beneath the canonical workspace root.

Release automation

Prepare release pull requests containing versions, lockfiles, notes, and an exact release intent. Require preparation to match the current base commit before merge.
Bind candidate approval to the source commit, archive and installer digests, and dependency-ordered crate publication plan.
Coordinate signing, draft verification, public installation and upgrade checks, and crates.io publication after independent approval.
Allow draft verification to read unpublished GitHub assets and retain exact tag and source-commit checks before executing release source.

The automated release lane requires the repository, environment, App, and registry configuration described in [release automation](../release-automation.md).

Changed package versions

All 18 workspace crates have changed packaged license metadata and documentation. Each advances to a new patch version, and internal dependency requirements select the corresponding new versions.

Package	Previous published version	Version
`tapid-archive`	`0.0.4`	`0.0.5`
`tapid-attestations`	`0.0.3`	`0.0.4`
`tapid-core`	`0.0.6`	`0.0.7`
`tapid-linker`	`0.0.6`	`0.0.7`
`tapid-lockfile`	`0.0.10`	`0.0.11`
`tapid-manifest`	`0.0.8`	`0.0.9`
`tapid-policy`	`0.0.3`	`0.0.4`
`tapid-protocol`	`0.0.4`	`0.0.5`
`tapid-publish`	`0.0.4`	`0.0.5`
`tapid-registry-client`	`0.0.6`	`0.0.7`
`tapid-release-client`	`0.0.4`	`0.0.5`
`tapid-resolver`	`0.0.6`	`0.0.7`
`tapid-runner`	`0.0.5`	`0.0.6`
`tapid-signatures`	`0.0.3`	`0.0.4`
`tapid-store`	`0.0.6`	`0.0.7`
`tapid-test-support`	`0.0.2`	`0.0.3`
`tapid-transparency`	`0.0.3`	`0.0.4`
`tapid`	`0.0.11`	`0.0.12`

Supporting crates retain independent version numbers. Previously published package versions are not replaced.