Feature Request: Add support for exporting a deterministic source snapshot of resolved manifest dependencies

# Summary

This proposal suggests adding a way to **materialize the fully resolved dependency graph from a `vcpkg.json` manifest (and lockfile, if present) into a local directory containing source snapshots of each dependency**.

The goal is to enable workflows where the manifest remains the single source of truth, while also supporting **reproducible, offline, and auditable builds based on vendored dependency sources**.

This is distinct from existing install/export workflows, which operate on built binaries rather than a structured, reusable source snapshot.

---

# Proposed Feature

Introduce a command such as:

```bash
vcpkg export --sources
```

or a dedicated command:

```bash
vcpkg snapshot
```

or

```bash
vcpkg vendor
```

The command would:

1. Read `vcpkg.json`
2. Resolve the full dependency graph (preferably respecting `vcpkg-lock.json`)
3. Fetch all required upstream sources and port-controlled sources
4. Apply port patches (behavior to be defined; see open questions)
5. Materialize a clean directory structure containing per-package source snapshots

---

# Expected Output

Example layout:

```
thirdparty/
fmt/
source/
zlib/
source/
openssl/
source/
```

Each entry would represent a **deterministic snapshot of the resolved dependency version**, aligned with the lockfile if present.

---

# Suggested Options (Open to Discussion)

```
--output-dir=
--include=direct|transitive|all
--exclude=
--apply-patches
--use-lockfile
--format=flat|namespaced
```

---

# Motivation

vcpkg currently supports:

* Dependency resolution via `vcpkg.json`
* Fetching and building sources internally
* Installing artifacts into a configured prefix
* Exporting **installed binaries** via `vcpkg export`
* Binary caching for reproducible rebuilds

However, there is no supported mechanism to:

> Produce a deterministic, repository-friendly snapshot of the **resolved source dependency graph**

This creates friction for workflows that require:

* Fully offline or air-gapped builds without reliance on port infrastructure at build time
* Security/compliance auditing of third-party source code as part of the repository
* Vendoring dependencies while still maintaining manifest-driven dependency management
* Reproducible builds where source provenance is explicitly captured in-tree

While binary caching helps reproducibility of builds, it does not provide a **portable, inspectable source-level dependency snapshot**.

---

# Key Design Considerations

## 1. Relation to existing workflows

This feature is intended to complement, not replace:

* `vcpkg install`
* `vcpkg export`
* binary caching

It focuses specifically on **source materialization of the resolved graph**, not installation artifacts.

---

## 2. Scope of “sources”

An open question is whether the export should include:

* raw upstream sources only, or
* upstream sources + vcpkg-applied patches, or
* a fully “resolved working tree” equivalent to what is used during build

---

## 3. Determinism

The feature should ideally be fully reproducible when used with:

* `vcpkg-lock.json`
* pinned baseline versions
* consistent registry state

---

# Use Cases

* **Air-gapped / offline builds** where network access is not available during CI or deployment
* **Security auditing**, where third-party sources must be reviewed and tracked in-repo
* **Enterprise compliance workflows** requiring explicit source provenance
* **Reproducible build systems** that prefer vendored dependencies over on-demand fetch/build

---

# Alternatives Considered

* Using `downloads/` or `buildtrees/`

* Not stable, not structured, not portable

* Manual scripting over portfiles

* Fragile, not deterministic across registry changes

* Binary caching

* Solves rebuild reproducibility, not source-level reproducibility or auditing

* Existing `vcpkg export`

* Exports built artifacts, not source snapshots

---

I’m happy to refine this further or help shape a concrete design if the direction is considered acceptable for the project.

Start by reviewing the existing vcpkg install and export workflows, then inspect how vcpkg.json and vcpkg-lock.json define and resolve dependencies. Compare the proposed source snapshot with current binary export behavior and clarify raw sources versus patched sources, lockfile handling, and output layout. Done requires an agreed design and a concrete command that produces deterministic per-package source snapshots.

Written by the indexing model from the issue text.