Vendors npm packages for browser code kept under priv.

List the packages in a package.json beside the sources, pinned to exact versions, and commit it with the npm.lock that vendoring writes:

{"private": true, "dependencies": {"lit-html": "3.3.3"}}

mix volt.priv.vendor priv/ts installs the locked versions and writes only the files the sources reach to node_modules beside them: the browser build of every imported module, the type declarations behind it, and each package's package.json and license. Keep that directory out of git and vendor before publishing, so the files ship in the Hex package and nothing is installed at runtime.

Volt.Priv.bundle!/3 resolves imports such as import { html } from 'lit-html' from there, and vendors on first use when the directory is missing, as in a git checkout.