Component install: branch on reference type — use npm install <pkg> for registry packages

[kriszyp]

The component installation process (introduced by CORE-2824) runs npm install inside the unzipped package directory for every deploy. This is npm's "source" installation flow — it installs devDependencies and runs the prepare script.

That's wrong for packages distributed via the npm registry (or other prepackaged URLs). Those are already "prepared" and should be installed via npm install <package-name>, which uses npm's "production" flow: prod-only dependencies, no prepare script (same as how transitive dependencies are installed).

Easy repro: try to install a non-harper registry package like ordered-binary — runs through the wrong code path.

Proposal (per Jira)

Align with npm's own branching by inspecting the package reference type:

• Git remote URL reference (git+ssh://, org/repo, etc.) → "source" flow:
  • npm pack <reference> to download.
  • If package.json#scripts.prepare exists → npm install (consider --production=false to be explicit) so devDependencies install too.
  • If no prepare script → npm install --production.
• Registry / tarball URL reference → "production" flow:
  • npm install <package> into a temp directory.
  • Move temp-dir/node_modules/my-package to the components directory.
  • Move the remaining temp-dir/node_modules contents into components/my-package/node_modules.

Acceptance criteria

• Registry-published components install via the production flow (no devDependencies, no prepare).
• Git-URL components continue to work via the source flow (with prepare/devDependencies as before).
• Test fixture covering both paths (a git-URL component and a registry-published component).
• Reference detection covers the common git-URL shapes: git+ssh://..., git+https://..., org/repo, github:org/repo, gitlab:....

Reference

npm install docs

---

🤖 Filed by Claude on behalf of Kris.