# `Volt.Priv.Vendor`
[🔗](https://github.com/elixir-volt/volt/blob/v0.23.0/lib/volt/priv/vendor.ex#L1)

Vendors npm packages for browser code kept under `priv`.

List the packages in a `package.json` beside the sources, pinned to exact
versions, and commit it with the `npm.lock` that vendoring writes:

```json
{"private": true, "dependencies": {"lit-html": "3.3.3"}}
```

`mix volt.priv.vendor priv/ts` installs the locked versions and writes only the
files the sources reach to `node_modules` beside them: the browser build of every
imported module, the type declarations behind it, and each package's
`package.json` and license. Keep that directory out of git and vendor before
publishing, so the files ship in the Hex package and nothing is installed at
runtime.

`Volt.Priv.bundle!/3` resolves imports such as `import { html } from 'lit-html'`
from there, and vendors on first use when the directory is missing, as in a git
checkout.

# `run!`

```elixir
@spec run!(
  Path.t(),
  keyword()
) :: [Path.t()]
```

Vendors the packages that `dir/package.json` lists into `dir/node_modules`.

## Options

  * `:update` — resolve the versions again instead of using `dir/npm.lock`

---

*Consult [api-reference.md](api-reference.md) for complete listing*