fix: use fast-npm-meta to get latest versions (#664)

Author: danielroe

app/components/Package/Versions.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { PackageVersionInfo, PackumentVersion } from '#shared/types'
+import type { PackageVersionInfo, SlimVersion } from '#shared/types'
 import { compare } from 'semver'
 import type { RouteLocationRaw } from 'vue-router'
 import { fetchAllPackageVersions } from '~/composables/useNpmRegistry'
@@ -14,7 +14,7 @@ import {
 
 const props = defineProps<{
   packageName: string
-  versions: Record<string, PackumentVersion>
+  versions: Record<string, SlimVersion>
   distTags: Record<string, string>
   time: Record<string, string>
 }>()
@@ -31,13 +31,6 @@ interface VersionDisplay {
   deprecated?: string
 }
 
-// Check if a version has provenance/attestations
-function hasProvenance(version: PackumentVersion | undefined): boolean {
-  if (!version?.dist) return false
-  const dist = version.dist as { attestations?: unknown }
-  return !!dist.attestations
-}
-
 // Build route object for package version link
 function versionRoute(version: string): RouteLocationRaw {
   return {
@@ -53,10 +46,7 @@ const versionToTags = computed(() => buildVersionToTagsMap(props.distTags))
 // Deduplicates so each version appears only once, with all its tags
 const allTagRows = computed(() => {
   // Group tags by version with their metadata
-  const versionMap = new Map<
-    string,
-    { tags: string[]; versionData: PackumentVersion | undefined }
-  >()
+  const versionMap = new Map<string, { tags: string[]; versionData: SlimVersion | undefined }>()
   for (const [tag, version] of Object.entries(props.distTags)) {
     const existing = versionMap.get(version)
     if (existing) {
@@ -88,7 +78,7 @@ const allTagRows = computed(() => {
         version,
         time: props.time[version],
         tags,
-        hasProvenance: hasProvenance(versionData),
+        hasProvenance: versionData?.hasProvenance,
         deprecated: versionData?.deprecated,
       } as VersionDisplay,
     }))

app/composables/useNpmRegistry.ts

@@ -1,17 +1,17 @@
 import type {
   Packument,
-  PackumentVersion,
   SlimPackument,
   NpmSearchResponse,
   NpmSearchResult,
   NpmDownloadCount,
   NpmPerson,
   PackageVersionInfo,
 } from '#shared/types'
+import { getVersions } from 'fast-npm-meta'
+import type { ResolvedPackageVersion } from 'fast-npm-meta'
 import type { ReleaseType } from 'semver'
 import { mapWithConcurrency } from '#shared/utils/async'
 import { maxSatisfying, prerelease, major, minor, diff, gt, compare } from 'semver'
-import { isExactVersion } from '~/utils/versions'
 import { extractInstallScriptsInfo } from '~/utils/install-scripts'
 import type { CachedFetchFunction } from '#shared/utils/fetch-cache-config'
 
@@ -93,17 +93,6 @@ async function fetchBulkDownloads(
   return downloads
 }
 
-/**
- * Encode a package name for use in npm registry URLs.
- * Handles scoped packages (e.g., @scope/name -> @scope%2Fname).
- */
-export function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
-}
-
 /** Number of recent versions to include in initial payload */
 const RECENT_VERSIONS_COUNT = 5
 
@@ -138,20 +127,28 @@ function transformPackument(pkg: Packument, requestedVersion?: string | null): S
   }
 
   // Build filtered versions object with install scripts info per version
-  const filteredVersions: Record<string, PackumentVersion> = {}
+  const filteredVersions: Record<string, SlimVersion> = {}
+  let versionData: SlimPackumentVersion | null = null
   for (const v of includedVersions) {
     const version = pkg.versions[v]
     if (version) {
-      // Strip readme from each version, extract install scripts info
-      const { readme: _readme, scripts, ...slimVersion } = version
-
-      // Extract install scripts info (which scripts exist + npx deps)
-      const installScripts = scripts ? extractInstallScriptsInfo(scripts) : null
-
+      if (version.version === requestedVersion) {
+        // Strip readme from each version, extract install scripts info
+        const { readme: _readme, scripts, ...slimVersion } = version
+
+        // Extract install scripts info (which scripts exist + npx deps)
+        const installScripts = scripts ? extractInstallScriptsInfo(scripts) : null
+        versionData = {
+          ...slimVersion,
+          installScripts: installScripts ?? undefined,
+        }
+      }
       filteredVersions[v] = {
-        ...slimVersion,
-        installScripts: installScripts ?? undefined,
-      } as PackumentVersion
+        ...((version?.dist as { attestations?: unknown }) ? { hasProvenance: true } : {}),
+        version: version.version,
+        deprecated: version.deprecated,
+        tags: version.tags as string[],
+      }
     }
   }
 
@@ -177,10 +174,28 @@ function transformPackument(pkg: Packument, requestedVersion?: string | null): S
     'keywords': pkg.keywords,
     'repository': pkg.repository,
     'bugs': pkg.bugs,
+    'requestedVersion': versionData,
     'versions': filteredVersions,
   }
 }
 
+export function useResolvedVersion(
+  packageName: MaybeRefOrGetter<string>,
+  requestedVersion: MaybeRefOrGetter<string | null>,
+) {
+  return useFetch(
+    () => {
+      const version = toValue(requestedVersion)
+      return version
+        ? `https://npm.antfu.dev/${toValue(packageName)}@${version}`
+        : `https://npm.antfu.dev/${toValue(packageName)}`
+    },
+    {
+      transform: (data: ResolvedPackageVersion) => data.version,
+    },
+  )
+}
+
 export function usePackage(
   name: MaybeRefOrGetter<string>,
   requestedVersion?: MaybeRefOrGetter<string | null>,
@@ -196,8 +211,7 @@ export function usePackage(
       })
       const reqVer = toValue(requestedVersion)
       const pkg = transformPackument(r, reqVer)
-      const resolvedVersion = getResolvedVersion(pkg, reqVer)
-      return { ...pkg, resolvedVersion, isStale }
+      return { ...pkg, isStale }
     },
   )
 
@@ -210,26 +224,6 @@ export function usePackage(
   return asyncData
 }
 
-function getResolvedVersion(pkg: SlimPackument, reqVer?: string | null): string | null {
-  if (!pkg || !reqVer) return null
-
-  // 1. Check if it's already an exact version in pkg.versions
-  if (isExactVersion(reqVer) && pkg.versions[reqVer]) {
-    return reqVer
-  }
-
-  // 2. Check if it's a dist-tag (latest, next, beta, etc.)
-  const tagVersion = pkg['dist-tags']?.[reqVer]
-  if (tagVersion) {
-    return tagVersion
-  }
-
-  // 3. Try to resolve as a semver range
-  const versions = Object.keys(pkg.versions)
-  const resolved = maxSatisfying(versions, reqVer)
-  return resolved
-}
-
 export function usePackageDownloads(
   name: MaybeRefOrGetter<string>,
   period: MaybeRefOrGetter<'last-day' | 'last-week' | 'last-month' | 'last-year'> = 'last-week',
@@ -600,32 +594,28 @@ export function useOrgPackages(orgName: MaybeRefOrGetter<string>) {
 const allVersionsCache = new Map<string, Promise<PackageVersionInfo[]>>()
 
 /**
- * Fetch all versions of a package from the npm registry.
+ * Fetch all versions of a package using fast-npm-meta API.
  * Returns version info sorted by version (newest first).
  * Results are cached to avoid duplicate requests.
  *
  * Note: This is a standalone async function for use in event handlers.
  * For composable usage, use useAllPackageVersions instead.
+ *
+ * @see https://github.com/antfu/fast-npm-meta
  */
 export async function fetchAllPackageVersions(packageName: string): Promise<PackageVersionInfo[]> {
   const cached = allVersionsCache.get(packageName)
   if (cached) return cached
 
   const promise = (async () => {
-    const encodedName = encodePackageName(packageName)
-    // Use regular $fetch for client-side calls (this is called on user interaction)
-    const data = await $fetch<{
-      versions: Record<string, { deprecated?: string }>
-      time: Record<string, string>
-    }>(`${NPM_REGISTRY}/${encodedName}`)
-
-    return Object.entries(data.versions)
-      .filter(([v]) => data.time[v])
-      .map(([version, versionData]) => ({
+    const data = await getVersions(packageName, { metadata: true })
+
+    return Object.entries(data.versionsMeta)
+      .map(([version, meta]) => ({
         version,
-        time: data.time[version],
-        hasProvenance: false, // Would need to check dist.attestations for each version
-        deprecated: versionData.deprecated,
+        time: meta.time,
+        hasProvenance: meta.provenance === 'trustedPublisher' || meta.provenance === true,
+        deprecated: meta.deprecated,
       }))
       .sort((a, b) => compare(b.version, a.version))
   })()

app/composables/usePackageComparison.ts

@@ -1,4 +1,5 @@
 import type { FacetValue, ComparisonFacet, ComparisonPackage } from '#shared/types'
+import { encodePackageName } from '#shared/utils/npm'
 import type { PackageAnalysisResponse } from './usePackageAnalysis'
 
 export interface PackageComparisonData {
@@ -222,13 +223,6 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
   }
 }
 
-function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
-}
-
 function computeFacetValue(facet: ComparisonFacet, data: PackageComparisonData): FacetValue | null {
   switch (facet) {
     case 'downloads':