Some text you want your agent to read lives in a repository whose author has never heard of vibe. A bridge package makes it installable anyway: you steward someone else's repository and publish an ordinary package that wraps it, with the original's authorship and licence kept apart from yours.
The agent scaffolds the package with `vibe init package`, marks it as a bridge in the manifest, and declares the upstream repository as an embedded source: its public address, the exact commit, the hash of the source tree and the upstream licence. Installing the package fetches that exact source into the consumer's machine [store](../glossary/index.xml#store) beside the package's own files. The bridge never becomes a second package: the wrapped repository is git content the resolver knows nothing about.
Vendored: you copied the upstream tree into the package and committed it. This is the cheapest bridge, plain files and the flag, with [hooks](../glossary/index.xml#hook) if the layout needs shaping. Submodule-backed: your workspace references the upstream through a git submodule, which a direct git install preserves live and which publication flattens into ordinary files. Reference-backed: the package repository holds only your metadata and adapters, and `[[embedded_source]]` names the upstream address, an immutable commit, the source-tree hash and the licence; installation fetches that exact source.
A declared source is authenticated twice when it arrives: the checkout must be at the declared commit, and the hash of its tree must equal the declared one. A `ref_hint` such as a tag name is only for people to read and never chooses bytes.
`authors` in the manifest names the people who wrote the bridge, its metadata and adapters, never the authors of the wrapped bytes; every embedded source records its own `upstream_authors`, and listings, locks and [indexes](../glossary/index.xml#index-registry) keep the two lists apart. The same for licences: `license` describes the bridge alone, each source records its upstream licence and an immutable link to it, and a bridge never presents upstream bytes as relicensed. The [coordinate](../glossary/index.xml#coordinate) names the product a consumer installs, not the codebase the packaging was written in: a bridge of Spec Kit may live at `org.speckit/speckit` whoever maintains it.
vibe fetches a package's submodules when it fetches the package, updates them with it, and makes their content available wherever the package lands: copied into the snapshot for the copying modes, live for an in-place checkout. Publication is the boundary: a [registry](../glossary/index.xml#registry) repository is a self-contained snapshot, so the publisher checks that every populated submodule is at its indexed commit and clean, copies its files in, removes `.gitmodules` and reports what it flattened.
A bridge is published and installed like any package; what it adds is provenance. The upstream can move on without you: bumping the bridge means changing the declared commit and hash, and publishing a new version.