A list of code you can pull into your repo as files you own, with a command that works out what else each piece needs. You end up with source in your tree that you can edit, and not a dependency someone else updates for you.
An agent can read, change and test code in your repo, which is harder with what sits inside a package. You pay in upkeep: nothing tells you when the original gets a fix, and code you copied without reading is still a stranger's code. Nobody we found has measured whether agents do better this way.
Say it to your agent
“Run bunx shadcn@latest view @acme/login-form, then add it with --dry-run and show me every file it would write and every package it would add. Read those files for network calls and env reads, and tell me what you find. If they are clean, add it, commit it alone, and note the source and date in docs/vendored.md.”