CodeVetter · Repo Unpack · Extension points
pnpm/pnpm
The clearest extension seams are typed command registration, ordered resolver composition, hook interfaces, reporter events, and backend traits. pnpr separates feature-surface mounting from registry provenance and storage implementation. Extension contracts frequently encode security or compatibility constraints, so adding an implementation requires preserving those constraints rather than only satisfying a type signature. NAPI exposes a separate host-facing boundary over the same Rust engine.
- CliCommand is a Clap-derived enum carrying command-specific argument types, with aliases and an external-subcommand fallback; cli_args::grammar caches the assembled command grammar in OnceLock.
- DefaultResolver composes Vec<Box<dyn Resolver>> in order: Ok(None) defers, the first claim wins, and exhaustion yields a stable unsupported-spec error; resolving-resolver-base also exposes a separate ResolutionVerifier seam.
- PnpmfileHooks is an async Send+Sync interface for manifest and resolution customization. Custom fetchers can request native CafsInfo, TempDir, LocalTarball, and RemoteTarball operations through callback channels with oneshot responses.
- Reporter extensions add typed LogEvent variants serialized with a name tag; channel names and payloads are designed for consumption by the TypeScript default reporter, making the wire contract part of extension correctness.
- pnpr surface_routes conditionally mounts resolver, artifact, pipeline, and registry route factories. Shared authentication/body-limit layering is applied after surface construction, and individual protocol routes add caller gates.
- Registry supports Hosted, Upstream, and ordered Router variants with declared package patterns. A router selects a claiming concrete source authoritatively; its not-found/unavailable result cannot fall through to a different origin.
- Storage and identity implementations plug into HostedBackend and AuthState's UserBackend/TokenBackend trait objects. Hosted backends own compare-and-set and blob-promotion differences; backend selection occurs during startup.
- The NAPI crate exports typed install, resolution, configuration, packing, and lockfile boundaries; its documented JS contract lives in the wrapper declarations, and module initialization installs the engine's tracing subscriber.