# Data flow — pnpm/pnpm > Canonical page: https://codevetter.com/unpack/pnpm/data-flow # Data flow — pnpm/pnpm Scanned commit b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02. Source inspection; upstream code and tests were not executed. CLI inputs become normalized arguments, configuration, manifest data, and lazily loaded lockfile state before entering the installation engine. The engine carries explicit workspace scope, lockfile policy, execution mode, shared caches, and verification state through resolution and materialization. Installed metadata and freshness records represent different stages of completion. Server reads add identity and declared provenance before consulting hosted storage or upstream caches. - Rust startup consumes args_os, handles executable aliases and the pm prefix, extracts ConfigOverrides, rewrites with current, parses Clap arguments, and retains child argv for pinned-package-manager dispatch. — [pnpm/crates/cli/src/lib.rs#L123-164](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/lib.rs#L123-L164) - Config is a merged runtime type rather than directly deserialized file data: defaults are overlaid with the auth/registry/network subset of .npmrc and structural pnpm-workspace.yaml settings. — [pnpm/crates/config/src/settings.rs#L39-55](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/config/src/settings.rs#L39-L55) [pnpm/crates/cli/src/state.rs#L44-52](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/state.rs#L44-L52) - State::install passes shared tarball and HTTP caches, resolved packages, Config, PackageManifest, and a lazy lockfile into Install::new; dedicated-project installs also share cross-project caches and completion coordination. — [pnpm/crates/cli/src/state.rs#L96-134](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/state.rs#L96-L134) [pnpm/crates/package-manager/src/install/entry_points.rs#L19-60](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/entry_points.rs#L19-L60) - InstallArgs converts CLI/config decisions into lockfile policy, execution mode, linker, architecture, and resolution seed settings. pnpr's remote policy controls server resolution, while local materialization uses the server-produced lockfile as frozen input. — [pnpm/crates/cli/src/cli_args/install.rs#L307-352](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/cli_args/install.rs#L307-L352) [pnpm/crates/cli/src/cli_args/install.rs#L413-425](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/cli_args/install.rs#L413-L425) - RunExecution loads lockfiles and hooked manifests, settles the wanted lockfile, creates Verification, dispatches the chosen path, materializes, and applies the result; shared Verification holds metadata cache, planned canonical fetches, and resolution verifiers. — [pnpm/crates/package-manager/src/install/run/execution.rs#L39-61](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/run/execution.rs#L39-L61) [pnpm/crates/package-manager/src/install/run/execution.rs#L70-116](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/run/execution.rs#L70-L116) [pnpm/crates/package-manager/src/install/run.rs#L406-414](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/run.rs#L406-L414) - Installed-state commit builds and writes .modules.yaml, then saves the current lockfile. Workspace freshness is written later, and a moved-tree filtered install deliberately skips that freshness update. — [pnpm/crates/package-manager/src/install/apply_materialization/commit.rs#L18-61](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/apply_materialization/commit.rs#L18-L61) [pnpm/crates/package-manager/src/install/apply_materialization.rs#L268-274](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/apply_materialization.rs#L268-L274) [pnpm/crates/package-manager/src/install/apply_materialization.rs#L296-299](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/package-manager/src/install/apply_materialization.rs#L296-L299) - pnpr metadata reads validate CanonicalPackageName, resolve a RegistrySource, authorize upstream access or apply hosted gates, then load bytes. Upstream responses pass through packument_response with tarball-base rewriting, OSV data, and abbreviated-response selection. — [pnpr/crates/pnpr/src/server/package_reads.rs#L223-270](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/src/server/package_reads.rs#L223-L270) [pnpr/crates/pnpr/src/server/upstream_packuments.rs#L244-268](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/src/server/upstream_packuments.rs#L244-L268) - pnpr's resolution cache distinguishes public and private fetch routes using RouteClass and a Footprint digest. RouteHook selects server-managed credentials at the auth-selection boundary; privacy depends on registry/package policy rather than simply whether a request carried credentials. — [pnpr/crates/route/src/lib.rs#L1-22](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/route/src/lib.rs#L1-L22) [pnpr/crates/route/src/lib.rs#L62-77](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/route/src/lib.rs#L62-L77) Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers. ## Public product links - [CodeVetter](https://codevetter.com/) - [Download](https://codevetter.com/download) - [Documentation](https://codevetter.com/docs/) - [Source](https://github.com/Codevetter/codevetter)