CodeVetter · Repo Unpack · Data flow
pnpm/pnpm
CLI inputs become normalized arguments, configuration, manifest data, and lazily loaded lockfile state before entering the installation engine. The engine carries explicit workspace scope, lockfile policy, execution mode, shared caches, and verification state through resolution and materialization. Installed metadata and freshness records represent different stages of completion. Server reads add identity and declared provenance before consulting hosted storage or upstream caches.
- Rust startup consumes args_os, handles executable aliases and the pm prefix, extracts ConfigOverrides, rewrites with current, parses Clap arguments, and retains child argv for pinned-package-manager dispatch.
- Config is a merged runtime type rather than directly deserialized file data: defaults are overlaid with the auth/registry/network subset of .npmrc and structural pnpm-workspace.yaml settings.
- State::install passes shared tarball and HTTP caches, resolved packages, Config, PackageManifest, and a lazy lockfile into Install::new; dedicated-project installs also share cross-project caches and completion coordination.
- InstallArgs converts CLI/config decisions into lockfile policy, execution mode, linker, architecture, and resolution seed settings. pnpr's remote policy controls server resolution, while local materialization uses the server-produced lockfile as frozen input.
- RunExecution loads lockfiles and hooked manifests, settles the wanted lockfile, creates Verification, dispatches the chosen path, materializes, and applies the result; shared Verification holds metadata cache, planned canonical fetches, and resolution verifiers.
- Installed-state commit builds and writes .modules.yaml, then saves the current lockfile. Workspace freshness is written later, and a moved-tree filtered install deliberately skips that freshness update.
- pnpr metadata reads validate CanonicalPackageName, resolve a RegistrySource, authorize upstream access or apply hosted gates, then load bytes. Upstream responses pass through packument_response with tarball-base rewriting, OSV data, and abbreviated-response selection.
- pnpr's resolution cache distinguishes public and private fetch routes using RouteClass and a Footprint digest. RouteHook selects server-managed credentials at the auth-selection boundary; privacy depends on registry/package policy rather than simply whether a request carried credentials.