Import from node_modules with bare module specifiers

[mbostock]

We currently support npm: protocol imports for importing directly from npm (via the jsDelivr CDN). But we could also support importing from your local node_modules with bare module specifiers, using rollup to build an ES module as needed.

[mbostock]

(Related #20, which also self-hosts libraries during build using npm: protocol imports.)

[Fil]

I've started to experiment with this — sharing in #1101 (current status: "it works for 'earcut'").

[danmarshall]

Hello! I'm new to Framework, so perhaps I'm missing a nuance of importing modules. Was there a design decision to specifically not use package.json as a way to specify dependencies? I've also seen #1009 that seems like might also have an industry-solved solution via usage of (both yarn & npm) package-lock files.
Lock files also have the added benefit of being crawled by Dependabot for security patches.

[mbostock]

@danmarshall Framework supports “implicit imports” for convenience, so you can e.g. start using d3 and it “just works” without you having to remember to npm install d3 ahead of time. By the same extension, we’ve made import * from "npm:whatever" “just work” for any library you want to use without needing to run npm install first.

Our intent is to support both implicit imports and explicit imports using a package manager (such as npm); that’s what this issue is about. So if you would rather manage your dependencies and versions explicitly using npm and package.json, you will be able to do that. But it won’t be a requirement — we’ll offer implicit imports in addition.

[g1776]

Adding node_modules support would also make versioning of specific packages more transparent, as well as allow better typescript support if we can have it as a devDependency.