>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3592907. --> Reported by: [joelpittet](https://www.drupal.org/user/160302) Related to !15 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The bundled <code>rrule.js</code> library is currently committed as raw vendor files in <code>lib/rrule.js/</code>. There is no lockfile or documented update process, so it is hard to tell which upstream release the files came from or how maintainers should update them.</p> <p>Composer is not a great fit for this because the dependency is JavaScript, not PHP. Keeping JavaScript dependencies managed with npm gives maintainers a clearer update path without changing how site builders install the module.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add npm tooling for project maintainers:</p> <ul> <li>Add <code>package.json</code> and <code>package-lock.json</code> with <code>rrule</code> as a development dependency.</li> <li>Copy the built <code>rrule.js</code> artifact into <code>lib/rrule.js/</code> during <code>npm install</code>.</li> <li>Keep the built file committed so Composer and drupal.org installs continue to work without Node.</li> <li>Document the update workflow in <code>CONTRIBUTING.md</code>.</li> <li>Add <code>node_modules/</code> to <code>.gitignore</code>.</li> </ul> <p>The intent is that npm is only used by maintainers when updating the bundled library. End users installing the module should see no change.</p>