Stage 0

• Implement a job for publishing pacquet
• Adding pacquet to the benchmarks at pnpm.io Adding pacquet to the pnpm benchmarks page pacquet#100
• Mentioning pacquet on the pnpm website and/or in the readme.

Stage 1 — Headless installer

Make pacquet install --frozen-lockfile feature-complete with pnpm install --frozen-lockfile.

Pacquet does not resolve dependencies in this stage. The user runs pnpm install (or pnpm install --lockfile-only) to produce pnpm-lock.yaml, then pacquet install --frozen-lockfile materializes node_modules from it. The lockfile is the contract between the two tools.

This mirrors pnpm's internal @pnpm/headless boundary, so the seam is natural.

Completed

• Link dependency binaries pacquet#330 (link dependency binaries)
• Support building dependencies (pnpm won't worked with node-newrelic. #397)
• .modules.yaml write and verify pacquet#331 (.modules.yaml write and verify)
• Support patchedDependencies
• Support side-effects cache
• Reporting engine + NDJSON in pnpm's @pnpm/core-loggers schema (Run post install scripts after all dependencies were installed #345). Visual parity via @pnpm/cli.default-reporter is tracked under Tier 4 below (EACCESS error on runas #344).

TODO

Ordered by implementation dependency — items lower in the list generally build on items above.

Tier 1 — Foundations. Correct snapshot filtering and lockfile loading; nothing downstream is sound until these are in place.

• Proper optionalDependencies support — umbrella pacquet#434 — Proper optionalDependencies support (umbrella). Without correct os / cpu / libc filtering, every install over-fetches and may break on platforms other than the build host. Subsumes Install respects every snapshot — no os/cpu/libc filter for optional deps pacquet#266.
• Lockfile loader v11 completeness. crates/lockfile/src/resolution.rs uses #[serde(deny_unknown_fields)] and is missing TarballResolution.gitHosted, BinaryResolution, and VariationsResolution. A real v11 pnpm-lock.yaml containing a github-tarball, a git-hosted package, or a runtime entry fails serde before the install dispatcher runs. Types covered piecemeal in Install git-hosted packages from pnpm-lock.yaml (frozen-lockfile) pacquet#436 and Install runtime dependencies (node@runtime:, deno@runtime:, bun@runtime:) from pnpm-lock.yaml pacquet#437; land them as a single unblocker so loading is correct before the install logic for each shape ships.
• Frozen-lockfile freshness check (Update ts-node to version 1.6.1 🚀 #447). Error when package.json dependencies don't match the lockfile importer entries, mirroring upstream's allProjectsAreUpToDate. Today pacquet installs regardless of staleness, which silently masks lockfile/manifest drift in CI.

Tier 2 — Real-world install enablers. Each unlocks a large slice of real pnpm repos and is largely independent of the others.

• Add workspace support to pacquet install --frozen-lockfile pacquet#431 — Support workspaces. Most real pnpm repos are workspaces; until this lands, pacquet can't install them at all.
• Partial install with --frozen-lockfile: read+write node_modules/.pnpm/lock.yaml and skip unchanged snapshots pacquet#433 — Partial install with --frozen-lockfile: read+write node_modules/.pnpm/lock.yaml and skip unchanged snapshots. Closes the warm-install perf gap.
• Add hoisting support: hoistPattern and publicHoistPattern pacquet#435 — Hoisting (hoistPattern, publicHoistPattern). Needed for ecosystem packages that rely on phantom dependencies and for editor tooling (eslint/prettier).

Tier 3 — New resolution types and layout modes. Each is a self-contained extension to the install pipeline; the ordering inside this tier is mostly arbitrary.

• Add global virtual store support to pacquet install --frozen-lockfile pacquet#432 — Support the global virtual store dir (Stage 1: frozen-lockfile install + per-importer registry). Follow-ups: Implement pacquet store prune for the global virtual store (#432 follow-up) pacquet#458 (prune sweep), Engine-agnostic GVS hash gating via allowBuilds-driven built_dep_paths (#432 follow-up) pacquet#459 (engine-agnostic hash gating); CI auto-detect / CONFIG_CONFLICT validation / e2e globalVirtualStore.ts port remain as bullets on Add global virtual store support to pacquet install --frozen-lockfile pacquet#432.
• Install git-hosted packages from pnpm-lock.yaml (frozen-lockfile) pacquet#436 — Install git-hosted packages from pnpm-lock.yaml (frozen-lockfile).
• Install runtime dependencies (node@runtime:, deno@runtime:, bun@runtime:) from pnpm-lock.yaml pacquet#437 — Install runtime dependencies (node@runtime:, deno@runtime:, bun@runtime:).
• Support nodeLinker: 'hoisted' — umbrella pacquet#438 — Support nodeLinker: 'hoisted' (umbrella). Alternative installer; orthogonal to Add hoisting support: hoistPattern and publicHoistPattern pacquet#435. Landed via the real-hoist crate + link_hoisted_modules.rs; popularity-based ident preference completed in feat(pacquet): cover the gap in nodeLinker: 'hoisted' #12510.
• Support named registries (will be published in v11.1).

Tier 4 — Consistency, polish, auxiliary. Quality-of-life fixes that close the parity gap once the structural work is in place.

• Surplus virtual-store cleanup. Remove packages from .pnpm/ that no longer appear in the lockfile (upstream's pruneVirtualStore). Sister to Partial install with --frozen-lockfile: read+write node_modules/.pnpm/lock.yaml and skip unchanged snapshots pacquet#433 — partial install decides what to add; this decides what to remove. Implemented as the mark-and-sweep StoreDir::prune in crates/store-dir/src/prune.rs (reporter wiring still tracked under Use pnpm's @pnpm/cli.default-reporter for terminal output (via NDJSON) pacquet#344).
• .modules.yaml validation triggering re-install on layout change. Upstream's validateModules forces a full re-import when nodeLinker / hoistPattern / publicHoistPattern / etc. differ between runs. Implemented as modules_consistent_with in crates/package-manager/src/install.rs, which gates the frozen-lockfile no-op fast path on layoutVersion / nodeLinker / hoistPattern / publicHoistPattern / virtualStoreDirMaxLength / storeDir / virtualStoreDir / included matching.
• Support proper auth pacquet#336 — Support proper auth.
• Use pnpm's @pnpm/cli.default-reporter for terminal output (via NDJSON) pacquet#344 — Use pnpm's @pnpm/cli.default-reporter for terminal output (via NDJSON). Brings visual parity with pnpm install on top of the reporting engine landed in feat(reporter): implement the reporting engine (NDJSON + Reporter trait) pacquet#345.
• Support proxy setting of pnpm - feat: proxy support (.npmrc + env-var cascade, HTTP/HTTPS/SOCKS) pacquet#476.
• Hoisted-bin precedence and lifecycle-script-created bins (deferred from #333) pacquet#342 — Hoisted-bin precedence and lifecycle-script-created bins.
• chore(reporter): backfill missing log events in already-ported code pacquet#347 — Backfill missing log events in already-ported code.

Integration milestone (between Stage 1 and Stage 2)

Once the headless installer is solid, integrate pacquet as an opt-in install backend for pnpm itself — for example via an install-backend=pacquet setting, or a Node N-API addon hooked at the @pnpm/headless seam. This ships Stage 1 value to every pnpm user, not just those who install pacquet directly, and provides a feedback firehose for parity validation before Stage 2 is built.

Stage 2 — Implementing resolution

Make pacquet install feature-complete with pnpm install (no --frozen-lockfile). Pacquet reads package.json + pnpm-workspace.yaml, resolves the dependency graph, writes a pnpm-lock.yaml that round-trips byte-identically with pnpm's, and materializes node_modules. This unlocks the install subcommands that today only work via pnpm: install (default), install --lockfile-only, add, update, remove, outdated, why.

Pacquet already has scaffolding from Stage 1: crates/registry, crates/resolving-npm-resolver (metadata fetch + cache, named registries, mirroring, trust checks), crates/resolving-resolver-base, and a full lockfile writer (crates/lockfile/save_lockfile). Stage 2 fills in the parts that turn a manifest into a resolved graph.

TODO

Ordered by implementation dependency — items lower in the list generally build on items above.

Tier 1 — Foundations. Nothing downstream is sound until these land.

• Bare-specifier parser & wanted-dependency model. Port @pnpm/resolving.parse-wanted-dependency (npm alias pnpm:foo@npm:bar, scoped names, tag vs. semver) and the protocol-routing dispatcher at the top of resolving/default-resolver/src/index.ts. Slots into the existing resolving-resolver-base crate.
• Resolution graph & recursion engine. Port installing/deps-resolver/src/resolveDependencyTree.ts and resolveDependencies.ts (~2.3k LoC combined). Owns dedupe by name (pkgIdsByName), preferredVersions, direct-vs-transitive context, resolutionsByDepPath cache, pendingNodes, linked-workspace tracking. Heart of this stage. Landed in crates/resolving-deps-resolver (resolve_workspace / resolve_importer / resolve_dependency_tree).
• Verify lockfile writer parity for newly-resolved entries. Pacquet's save_lockfile round-trips Stage 1 inputs; confirm it serializes new packages / snapshots / importers / catalogs / overrides / patchedDependencies byte-identically with pnpm so pnpm install after pacquet install produces no diff. crates/lockfile/save_lockfile now writes all of these sections from a fresh resolution (env-document prefix preserved).

Tier 2 — Per-protocol resolvers. Each unlocks a class of spec. Largely independent.

• npm resolver — version picking. Port pickPackage.ts / pickPackageFromMeta.ts: semver matching, tag handling, allowedDeprecatedVersions, minimumReleaseAge. Metadata fetch already exists in resolving-npm-resolver.
• Git resolver. Port resolving/git-resolver: git+ssh, github:owner/repo#ref, #semver:^1 selectors, GitHub-tarball preference. Pairs with the Stage-1 git-fetcher crate.
• Tarball resolver. Port resolving/tarball-resolver: direct https://…/foo.tgz resolution + integrity verify.
• Local-path / link / file resolver. Port resolving/local-resolver: file:../foo, link:../foo, injected deps. The Stage-1 directory-fetcher crate handles the fetch side.
• JSR specifier parser. Port resolving/jsr-specifier-parser; wires into the JSR path already drafted in resolving-npm-resolver.
• Runtime resolver. Pick versions for node@runtime: / deno@runtime: / bun@runtime:. Stage 1 already loads them from the lockfile; resolution still has to choose a version and emit the entry.
• Catalog protocol. Resolve catalog:default / catalog:react18 through pnpm-workspace.yaml's catalog(s):, then dispatch to npm. Snapshot the selections into the lockfile's catalogs: block.
• Workspace protocol. workspace:* / workspace:^ / workspace:~ / workspace:1.2.3 → link: lockfile entry + publish-time spec rewrite. Pacquet already loads workspaces (Add workspace support to pacquet install --frozen-lockfile pacquet#431).

Tier 3 — Resolution policies & constraints. Behaviors layered on top of the recursion that change which version wins or whether the install proceeds.

• Peer dependency resolution. Port resolvePeers.ts (~1k LoC). Produces dep paths with peer hashes (foo@1.0.0(react@18.0.0)). Heaviest single port in this stage.
• Overrides. pnpm.overrides from pnpm-workspace.yaml. Apply at parseWantedDependency time; record in the lockfile's overrides: block.
• allowedDeprecatedVersions + deprecation warning emission. Wire to the same NDJSON deprecation channel pnpm uses so @pnpm/cli.default-reporter formats them identically. Partial: the allowedDeprecatedVersions config field is parsed, but no pnpm:deprecation event is emitted yet (so the allow-list has nothing to suppress).
• blockExoticSubdeps. Reject git/tarball/file specs in transitive deps.
• patchedDependencies resolution-side. Hash the patch and attach pkgIdWithPatchHash to dep paths so the installer picks the patched store entry. crates/lockfile/pkg_id_with_patch_hash.rs already exists.
• allowNonAppliedPatches + verifyPatches. Partial: verify_patches (with an allow_unused_patches parameter) and the ERR_PNPM_UNUSED_PATCH diagnostic exist in crates/patching, and the resolver collects applied_patches, but no allowNonAppliedPatches config field is wired and verify_patches is not yet invoked from the install flow.
• minimumReleaseAge at resolve time. Today it gates global installs only; extend it so new transitive versions are also rejected, mirroring upstream's resolve-path enforcement.

Tier 4 — Hooks & custom resolution. Both require running user JavaScript inside pacquet — design call needed.

• .pnpmfile.cjs / pnpmfile.cjs execution. Port the readPackage, afterAllResolved, preResolution, filterLog hook surface from hooks/pnpmfile. Implemented in crates/hooks by shelling out to node via a worker-pool runtime (node_runtime.rs); readPackage / preResolution / afterAllResolved / updateConfig are wired into the resolution pipeline. (filterLog trait method exists but is not yet consumed by the reporter.)
• Custom resolvers (hooks.types.CustomResolver). Extracted from the pnpmfile and prepended to the resolver chain via CustomResolverAdapter; covered by crates/cli/tests/custom_resolvers.rs.

Tier 5 — Commands unlocked by resolution. Stage 1 only delivers pacquet install --frozen-lockfile. Once resolution lands, each of these is a CLI surface port that follows the underlying capability.

• pacquet install (default, non-frozen).
• pacquet install --lockfile-only.
• pacquet add (incl. -D, --save-peer, --save-exact, --save-prefix).
• pacquet update (incl. --latest, updateMatching, -i).
• pacquet remove.
• pacquet outdated.
• pacquet why.

Tier 6 — Consistency, polish, auxiliary. Close the parity gap once the structural work is in place.

• Round-trip stability. A re-resolve that picks the same versions must produce a byte-identical pnpm-lock.yaml (key ordering, anchor reuse, no spurious churn).
• Project-manifest update on add / remove / update. Port updateProjectManifest.ts: respect save-prefix, save-exact, save-workspace-protocol. PackageManifest add/remove/update + crates/workspace-manifest-writer (format-preserving catalog writes) handle this.
• afterAllResolved / preResolution log-event parity so @pnpm/cli.default-reporter formats them identically. Partial: readPackage / afterAllResolved context.log() calls emit pnpm:hook events; preResolution's info/warn logging is not yet routed to pnpm: channels.
• Backfill missing log emissions in newly-ported resolution code (sister to chore(reporter): backfill missing log events in already-ported code pacquet#347).
• E2E port. Mirror pnpm/test/install.ts, add.ts, update.ts, remove.ts, outdated.ts into pacquet's test layout as each capability lands. Each command now has a crates/cli/tests/*.rs suite (install/add/update/remove/outdated/why + ~30 more); ongoing parity backfill tracked in pacquet/plans/TEST_PORTING.md.

Integration milestone (between Stage 2 and Stage 3)

Once resolution is solid, extend the Stage-1 → Stage-2 opt-in seam (install-backend=pacquet / N-API) to route everyday pnpm install calls through pacquet end-to-end — not just --frozen-lockfile. Stage 3 then targets the non-install command surface (publish, audit, dlx, exec, run, store).

Stage 3 — Non-install command surface

Stages 1–2 cover the dependency-management surface: install (incl. --frozen-lockfile / --lockfile-only), add, update, remove, outdated, why. Stage 3 tracks every remaining pnpm command. Pacquet's crates/cli already implements a handful of these beyond install; the rest are unported.

Status legend: [x] = a handler exists in pacquet's CLI today (a parity audit against pnpm's flags/output is still required before it can be called complete); [ ] = not ported.

Tracking

Grouped by the pnpm package that owns each command (see the imports at the top of pnpm/src/cmd/index.ts). Aliases are listed after the primary name.

Script & process — @pnpm/exec.commands

• run / run-script (incl. test, start script aliases)
• exec
• dlx
• create taken
• restart (+ stop)

Store & cache — @pnpm/store.commands, @pnpm/cache.commands

• store (+ subcommands)
• cat-file
• cat-index
• find-hash
• cache

Project scaffolding — @pnpm/workspace.commands

• init

Workspace install helpers — @pnpm/installing.commands

• import
• dedupe
• prune
• fetch
• link / ln
• unlink / dislink

Inspection & query — @pnpm/deps.inspection.commands

• list / ls
• ll / la
• peers
• view / info / show / v @Safort
• bugs
• repo
• docs / home

Compliance — @pnpm/deps.compliance.commands

• audit @zkochan
• licenses
• sbom

Build / lifecycle — @pnpm/building.commands

• rebuild / rb @zkochan
• approve-builds @zkochan
• ignored-builds @zkochan

Patching — @pnpm/patching.commands (taken by @spencer17x)

• patch
• patch-commit
• patch-remove

Publishing & releasing — @pnpm/releasing.commands

• publish (taken by @KSXGitHub)
• pack (taken by @KSXGitHub)
• pack-app @zkochan
• deploy @zkochan
• stage
• version (taken by @Safort)

Registry access — @pnpm/registry-access.commands, @pnpm/auth.commands

• login / adduser (taken by @KSXGitHub)
• logout (taken by @KSXGitHub)
• whoami (taken by @Safort)
• ping @Safort
• search / s / se / find
• deprecate
• undeprecate
• unpublish
• dist-tag / dist-tags @zkochan
• owner / owners
• star
• stars
• unstar

Config & manifest — @pnpm/config.commands, @pnpm/pkg-manifest.commands

• config / c (+ get, set) @zkochan
• pkg
• set-script / ss (taken by @Safort)

Engine & self-management — @pnpm/engine.pm.commands, @pnpm/engine.runtime.commands

• self-update @zkochan
• setup @zkochan
• with @zkochan
• runtime / rt @zkochan

Completion — @pnpm/cli.commands

• completion @spencer17x

pnpm CLI built-ins — pnpm/src/cmd

• bin (taken by @exidniy)
• root (taken by @exidniy)
• clean / purge
• ci / clean-install / ic / install-clean
• install-test / it
• recursive / multi / m

Not tracked: access, edit, issues, prefix, profile, team, token, xmas — these are stubs in pnpm itself (they throw NOT_IMPLEMENTED and defer to the npm CLI), so there is nothing to port.

---

Stage 3 tracking section drafted by an agent (Claude Code, claude-opus-4-8).

---

Stage 2 plan drafted by an agent (Claude Code, claude-opus-4-7).