# Extension points — pnpm/pnpm

> Canonical page: https://codevetter.com/unpack/pnpm/extension-points

# Extension points — pnpm/pnpm

Scanned commit b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The clearest extension seams are typed command registration, ordered resolver composition, hook interfaces, reporter events, and backend traits. pnpr separates feature-surface mounting from registry provenance and storage implementation. Extension contracts frequently encode security or compatibility constraints, so adding an implementation requires preserving those constraints rather than only satisfying a type signature. NAPI exposes a separate host-facing boundary over the same Rust engine.
- CliCommand is a Clap-derived enum carrying command-specific argument types, with aliases and an external-subcommand fallback; cli_args::grammar caches the assembled command grammar in OnceLock. — [pnpm/crates/cli/src/cli_args/cli_command/commands.rs#L16-36](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/cli_args/cli_command/commands.rs#L16-L36) [pnpm/crates/cli/src/cli_args/cli_command/commands.rs#L260-271](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/cli_args/cli_command/commands.rs#L260-L271) [pnpm/crates/cli/src/cli_args.rs#L125-131](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/src/cli_args.rs#L125-L131)
- DefaultResolver composes Vec<Box<dyn Resolver>> in order: Ok(None) defers, the first claim wins, and exhaustion yields a stable unsupported-spec error; resolving-resolver-base also exposes a separate ResolutionVerifier seam. — [pnpm/crates/resolving-default-resolver/src/lib.rs#L1-10](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/resolving-default-resolver/src/lib.rs#L1-L10) [pnpm/crates/resolving-default-resolver/src/lib.rs#L21-49](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/resolving-default-resolver/src/lib.rs#L21-L49) [pnpm/crates/resolving-resolver-base/src/lib.rs#L1-18](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/resolving-resolver-base/src/lib.rs#L1-L18) [pnpm/crates/resolving-resolver-base/src/lib.rs#L26-40](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/resolving-resolver-base/src/lib.rs#L26-L40)
- PnpmfileHooks is an async Send+Sync interface for manifest and resolution customization. Custom fetchers can request native CafsInfo, TempDir, LocalTarball, and RemoteTarball operations through callback channels with oneshot responses. — [pnpm/crates/hooks/src/lib.rs#L27-44](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/hooks/src/lib.rs#L27-L44) [pnpm/crates/hooks/src/lib.rs#L106-120](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/hooks/src/lib.rs#L106-L120)
- Reporter extensions add typed LogEvent variants serialized with a name tag; channel names and payloads are designed for consumption by the TypeScript default reporter, making the wire contract part of extension correctness. — [pnpm/crates/reporter/src/lib.rs#L1-12](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/reporter/src/lib.rs#L1-L12) [pnpm/crates/reporter/src/lib.rs#L32-68](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/reporter/src/lib.rs#L32-L68)
- pnpr surface_routes conditionally mounts resolver, artifact, pipeline, and registry route factories. Shared authentication/body-limit layering is applied after surface construction, and individual protocol routes add caller gates. — [pnpr/crates/pnpr/src/server/routing.rs#L74-87](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/src/server/routing.rs#L74-L87) [pnpr/crates/pnpr/src/server/routing.rs#L179-218](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/src/server/routing.rs#L179-L218) [pnpr/crates/pnpr/src/server/routing.rs#L339-355](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/src/server/routing.rs#L339-L355)
- Registry supports Hosted, Upstream, and ordered Router variants with declared package patterns. A router selects a claiming concrete source authoritatively; its not-found/unavailable result cannot fall through to a different origin. — [pnpr/crates/registry/src/lib.rs#L8-26](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/registry/src/lib.rs#L8-L26) [pnpr/crates/registry/src/lib.rs#L43-62](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/registry/src/lib.rs#L43-L62)
- Storage and identity implementations plug into HostedBackend and AuthState's UserBackend/TokenBackend trait objects. Hosted backends own compare-and-set and blob-promotion differences; backend selection occurs during startup. — [pnpr/crates/storage/src/backend.rs#L13-50](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/storage/src/backend.rs#L13-L50) [pnpr/crates/storage/src/backend.rs#L65-82](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/storage/src/backend.rs#L65-L82) [pnpr/crates/auth/src/lib.rs#L130-138](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/auth/src/lib.rs#L130-L138) [pnpr/crates/auth/src/lib.rs#L163-184](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/auth/src/lib.rs#L163-L184)
- The NAPI crate exports typed install, resolution, configuration, packing, and lockfile boundaries; its documented JS contract lives in the wrapper declarations, and module initialization installs the engine's tracing subscriber. — [pnpm/crates/napi/src/lib.rs#L4-15](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/napi/src/lib.rs#L4-L15) [pnpm/crates/napi/src/lib.rs#L26-41](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/napi/src/lib.rs#L26-L41) [pnpm/crates/napi/src/lib.rs#L66-72](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/napi/src/lib.rs#L66-L72)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)