So Reflame does not use any of the exact same high-level, user-facing tools you might be using locally, like vite, webpack, npm, yarn, etc. Those tools are designed to be ran locally, and so if we wanted to run them on a server in a shared environment (e.g. in CI), we'd need to spin up a VM, install those tools, git clone the repo, before even starting to do any real work. This makes it impossible to offer the kinds of latencies Reflame is targetting.
To answer your question on what Reflame actually does: it composes a bunch of the low-level primitives behind the tools we run locally (along with a boatload of custom code), and runs them in a server, against every single module that gets sent in through our GitHub app and VSCode extension, and then deploys the result.
For npm packages specifically, instead of running npm install, it currently makes use of the lower level arborist library that npm is built on top of, to run package installations server side, then transforms, caches, and deploys the results. This was done to get an MVP out quickly and is not an ideal setup at the moment, because the caching behind it is not very granular. The first time you install a set of packages our servers have never seen before, it can take a while, but subsequent times it becomes instant.
This is really the achilles heel in our instant deployment story, and something I want to work on soon is a custom package resolution system using content addressing, similar to pnpm, that's more amenable to space-efficient, shared granular caching.
Package locking and private npm packages (private github repos are already supported, in case that's what you were referring to?) are not yet supported, but should be simple to add on top of the existing system if there is demand. Let me know if these are blockers for you!