RFC: Cargo ecosystem — pnpm for Rust crates, pnpr as a crate registry

[zkochan]

Summary

Adds text/0000-cargo-ecosystem.md, an RFC that makes pnpm a package manager for Rust crates and pnpr a crate registry.

Why: since the CLI rewrite in Rust, pnpm no longer dogfoods itself. The Rust workspace's 714 crates.io dependencies (811 lockfile entries) are fetched by cargo, cached by Swatinem/rust-cache, audited by cargo-deny and bumped by Dependabot. None of it touches pnpm or pnpr.

What the RFC proposes:

• pnpm resolves, fetches, verifies and materializes crates; cargo only compiles. Crates are hardlinked from the existing store into .pnpm/crates/<source>/ as cargo directory sources, wired up through a pnpm-managed region of a committed .cargo/config.toml.
• Cargo.lock stays the one lockfile for crates, written in cargo's canonical form and accepted by cargo --locked.
• Independent ecosystem installers run concurrently and share one configured HTTP client, preserving the aggregate network limits; the coordinator is designed for later languages such as Python/PyPI.
• A new PubGrub-based resolver crate with cargo's semantics (one version per semver-compatible range, backtracking, feature unification, MSRV, yank rules), tested differentially against cargo's resolver, starting with reproducing this repository's own lockfile byte for byte.
• Opt-in via cargo.enabled in pnpm-workspace.yaml; cargo's [registries] and credentials.toml are honoured rather than duplicated.
• A crate: specifier protocol across add/remove/update/outdated/list/why/audit/licenses/publish/pack, with [workspace.dependencies] as the crate catalog.
• pnpr gains protocol: cargo on registries under the existing mounts model: sparse index, download, publish/yank/owners/search web API, bare-token auth, and an upstream mode mirroring crates.io.
• A four-milestone dogfooding plan for pnpm/pnpm, where milestone 1 (pnpr proxying crates.io for plain cargo) needs no pnpm changes.

Decided: new ecosystem features ship in the Rust pnpm v12 CLI, following the repository's v12-only feature-development policy.

The architecture section records the real Python integration in pnpm/pnpm#14586: opt-in install/add/run/exec support, PEP 440/508 resolution, native wheels, shared HTTP/auth/CAS, and staged environment publication. Python retains standard pylock.toml; uv independently installed a generated real-PyPI lockfile. The integration now shares a dedicated lifecycle crate across install and mixed add: native metadata ownership, concurrent preparation, settlement, publication and reverse rollback. Cargo and Python return prepared projections; npm retains explicit in-place semantics. Target identity remains native, and the boundary is internal rather than a public plugin API. Source builds, universal locking and crash recovery remain outside this slice.

A duplication audit also consolidated tarball and ZIP cache validation, offline gating, HTTP request setup, extraction retries, progress and store publication. npm packages, Cargo crates, Python wheels and runtime binaries use these same implementations. Container decoding and native dependency semantics remain separate, with cross-format contract tests guarding the common behavior.

Open questions (naming, --optional, whether to split the pnpr half into pnpr/text/) are listed at the end of the document.

🤖 Generated with Claude Code, then continued with Codex.

https://claude.ai/code/session_0167jVFmSFDDzaTKAvCEbC1Y

---

Updated by an agent (Codex, GPT-5).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[zkochan]

Recorded the architecture exposed by the Cargo proof of concept in 688d198: an ecosystem-neutral install kernel, ecosystem-owned resolver and lockfile semantics, staged cross-ecosystem changes, normalized auth routing, and an explicit zero-regression requirement for npm-only installs enforced by the existing integrated benchmarks.

---

Written by an agent (Codex, gpt-5.6-sol).

[zkochan]

The verified-artifact ingestion slice has landed in pnpm/pnpm#14574. Commit ff49aaa updates this RFC with the implementation finding that integrity identifies immutable bytes, while projection inputs identify the extracted file map and therefore belong in every memory/disk cache key. It also records the legacy-row migration rules that fell out of review.

---

Written by an agent (Codex, gpt-5.6-sol).

[zkochan]

Implementation update: pnpm/pnpm#14578 merged and the RFC now records the request-auth invariants learned from it.

The important boundary is that the shared network layer routes already-formatted headers by URL. npm and Cargo configuration readers retain their own formats, schemes, and precedence rules. Cargo credential discovery happens once and only on the Cargo path; redirect destinations are authorized independently; parse failures do not echo credential contents. The current crates.io token is deliberately scoped to the index host, while named/private registry mapping remains a later Cargo source-identity slice.

---

Written by an agent (Codex, gpt-5.6-sol).