rfc(pnpr): patch-provider integration by zkochan · Pull Request #14 · pnpm/rfcs

rfc(pnpr): patch-provider integration (vendor-as-origin and patch overlay mounts)

zkochan

committed

1ee355c

rfc(pnpr): adopt patched artifacts via package aliases instead of prerelease grafting

zkochan

committed

c3a2470

rfc(pnpr): add substitute mode so fresh resolutions are auto-patched

zkochan

committed

3a686ce

rfc(pnpr): substitute mode serves a registry-provided overrides object

zkochan

committed

699c0e8

rfc(pnpr): size and caching analysis for the overrides document

zkochan

committed

809c232

rfc(pnpr): apply the patched-versions document after version selection, not as overrides

zkochan

committed

bada30f

rfc(pnpr): frame the client mechanism as a resolution-overrides extension

zkochan

committed

b96e2da

rfc(pnpr): extend existing exact-version overrides to match picked versions, not a new override kind

zkochan

committed

abc07e8

rfc(pnpr): record applied registry overrides in the lockfile

zkochan

committed

4a93e6e

rfc(pnpr): server-side resolution applies the same pinned map, reports applied entries, keys its cache

zkochan

committed

ab38d43

rfc(pnpr): quantify substitution resolution cost and the integrity fast path

zkochan

committed

7e1ac03

rfc(pnpr): patched-versions entries carry integrity, making substitution free and pre-pinned

zkochan

committed

70c7fed

rfc(pnpr): revert to plain-spec entries; one override mechanism beats a fetch-free fork

zkochan

committed

c3b293b

rfc(pnpr): the patch source is an uncontrolled origin; pnpr's serving path is the enforced boundary

zkochan

committed

5250468

rfc(pnpr): prior art for post-pick substitution — Go replace, Cargo [replace], npm RFC 0036 timing bugs

zkochan

committed

60dc0cb

rfc(pnpr): why Cargo's [patch] route is structurally unavailable in npm's model

zkochan

committed

6b7e873

rfc(pnpr): substitute mode via packument annotations selected by the resolver

zkochan

committed

fb6c552

rfc(pnpr): advertise mode adopts via accept lists, not overrides; overrides demoted to blunt manual path

zkochan

committed

3b5114e

rfc: drop apply posture, registry-side enforcement is the security boundary; add companion pnpm RFC for post-pick substitution

zkochan

committed

541d2ed

rfc: align with pnpr registries rename (mounts -> registries, patterns on registries, routers as ordered sources)

zkochan

committed

b3aceaf

rfc: adopt overrides after all — exact-version selectors match picked versions as a semantics fix; annotations are registry-supplied overrides; drop rules config and lockfile record

zkochan

committed

6043a31

rfc(pnpr): align with per-registry packages: map (RFC PR 17) — namespace and rules in one declaration

zkochan

committed

bb1d740

Navigation Menu

Uh oh!

rfc(pnpr): patch-provider integration - #14

rfc(pnpr): patch-provider integration#14
zkochan wants to merge 22 commits into
mainfrom
rfc/pnpr-patch-providers

Commits on Jul 3, 2026

rfc(pnpr): patch-provider integration (vendor-as-origin and patch overlay mounts)

rfc(pnpr): adopt patched artifacts via package aliases instead of prerelease grafting

rfc(pnpr): add substitute mode so fresh resolutions are auto-patched

rfc(pnpr): substitute mode serves a registry-provided overrides object

rfc(pnpr): size and caching analysis for the overrides document

rfc(pnpr): apply the patched-versions document after version selection, not as overrides

rfc(pnpr): frame the client mechanism as a resolution-overrides extension

rfc(pnpr): extend existing exact-version overrides to match picked versions, not a new override kind

rfc(pnpr): record applied registry overrides in the lockfile

rfc(pnpr): server-side resolution applies the same pinned map, reports applied entries, keys its cache

rfc(pnpr): quantify substitution resolution cost and the integrity fast path

rfc(pnpr): patched-versions entries carry integrity, making substitution free and pre-pinned

rfc(pnpr): revert to plain-spec entries; one override mechanism beats a fetch-free fork

rfc(pnpr): the patch source is an uncontrolled origin; pnpr's serving path is the enforced boundary

rfc(pnpr): prior art for post-pick substitution — Go replace, Cargo [replace], npm RFC 0036 timing bugs

rfc(pnpr): why Cargo's [patch] route is structurally unavailable in npm's model

rfc(pnpr): substitute mode via packument annotations selected by the resolver

rfc(pnpr): advertise mode adopts via accept lists, not overrides; overrides demoted to blunt manual path

rfc: drop apply posture, registry-side enforcement is the security boundary; add companion pnpm RFC for post-pick substitution

rfc: align with pnpr registries rename (mounts -> registries, patterns on registries, routers as ordered sources)

rfc: adopt overrides after all — exact-version selectors match picked versions as a semantics fix; annotations are registry-supplied overrides; drop rules config and lockfile record

rfc(pnpr): align with per-registry packages: map (RFC PR 17) — namespace and rules in one declaration