the packages.json **is** a composer repository, even when accessible through a local path.