Module vendor 

Vendor packages into a web_modules/ tree and build the import map.

Orchestration over npm_utils: each PackageSpec names a source (an npm package + semver range, or a GitHub archive at a ref), how to extract it, and where its files land. Work is cache-guarded (a per-package version/ref marker + a cross-process lock), so a second build with unchanged specs does no extraction.

For the common case (an npm package whose browser assets are vended and whose import-map entries are auto-derived from its package.json), a spec is just PackageSpec::npm:

use std::path::Path;
use web_modules::vendor::{vendor, PackageSpec};

let specs = [PackageSpec::npm("lit", "^3")];
let importmap = vendor(Path::new("web/web_modules"), "/web_modules", &specs)?;
println!("{}", importmap.to_script_tag());

The builder also covers the awkward cases a real app hits: a full package staged into a sibling node_modules/ as a SCSS load path, a single file extracted and renamed (a sprite, a font), a GitHub (non-npm) source, or a caller-supplied keep-filter. See PackageSpec and Extract.

Structs

PackageSpec

One package to vendor, built fluently.

Enums

Extract

How a package’s archive is extracted into its destination directory.

Functions

keep_browser_assets

Default selection: keep browser assets (.js/.mjs/.css) plus .scss sources (so packages like Bootstrap can be themed from their SCSS) while dropping TypeScript sources and the node-only / development build trees some packages ship.

read_package_json

Read a package.json’s dependencies, splitting them: registry ranges → vendoring PackageSpecs (kept verbatim; github: → git specs), and local path-deps (file:/link:/.//../) → Mounts, the target dir, named by the dependency key (npm’s file: rule), honoring the target’s web_modules.root. Other protocols (workspace:/portal:/npm:) are skipped. Use this to compose sibling dirs straight from a manifest; specs_from_package_json is the vend-only subset.

specs_from_package_json

Build vendoring specs from the dependencies of a package.json. Keep your browser dependencies in a real package.json next to your sources and vendor them with Rust. Registry ranges are preserved verbatim (^3, ~1.2, …); a github:owner/repo#ref or git URL becomes a git spec; and local protocols (file:/link:/workspace:/portal:) are skipped. Each entry defaults to browser-asset extraction with an auto-derived import map.

specs_from_package_json_sections

Like specs_from_package_json, but read the named dependency sections (e.g. &["dependencies", "devDependencies"]). The first section to name a package wins; later duplicates are dropped. The webDependencies whitelist is not applied; that is specs_from_package_json’s browser-vend rule.

vendor

Resolve + download + extract every spec into vendor_dir, returning the composed Importmap with URLs rooted at mount (e.g. "/web_modules"). Cache-guarded per package; import-map entries follow each spec’s strategy.