This would definitely be done by "vendor"-ing all the dependency sources into the tree, no? Unless that's not the proposal, which I can't imagine it isn't, then

This would definitely be done by "vendor"-ing all the dependency sources into the tree, no? Unless that's not the proposal, which I can't imagine it isn't, then I don't see how "web-based" is relevant.