refactor: migrate to fast-npm-meta

Author: 9romise

package.json

@@ -77,12 +77,12 @@
     "*": "eslint --fix"
   },
   "devDependencies": {
-    "@npm/types": "^2.1.0",
     "@types/node": "^25.1.0",
     "@types/vscode": "1.101.0",
     "@vida0905/eslint-config": "^2.9.0",
     "@vscode/vsce": "^3.7.1",
     "eslint": "^9.39.2",
+    "fast-npm-meta": "^1.0.0",
     "husky": "^9.1.7",
     "jsonc-parser": "^3.3.1",
     "module-replacements": "^2.11.0",

pnpm-lock.yaml

@@ -32,21 +32,27 @@ export class VersionCompletionItemProvider<T extends Extractor> implements Compl
 
     const prefix = extractVersionPrefix(version)
 
-    let versionsKV = Object.values(pkg.versions)
+    const items: CompletionItem[] = []
 
-    if (config.versionCompletion === 'provenance-only')
-      versionsKV = versionsKV.filter(({ hasProvenance }) => hasProvenance)
+    for (const version in pkg.versionsMeta) {
+      const meta = pkg.versionsMeta[version]
+
+      if (config.versionCompletion === 'provenance-only' && !meta.provenance)
+        continue
 
-    return versionsKV.map(({ version, tag }) => {
       const text = `${prefix}${version}`
       const item = new CompletionItem(text, CompletionItemKind.Value)
 
       item.range = this.extractor.getNodeRange(document, versionNode)
       item.insertText = text
+
+      const tag = pkg.versionToTag.get(version)
       if (tag)
         item.detail = tag
 
-      return item
-    })
+      items.push(item)
+    }
+
+    return items
   }
 }

src/providers/completion-item/version.ts

@@ -1,5 +1,5 @@
 import type { DependencyInfo, Extractor, ValidNode } from '#types/extractor'
-import type { ResolvedPackument } from '#utils/npm'
+import type { PackageVersionsInfoWithMetadata } from 'fast-npm-meta'
 import type { Awaitable } from 'reactive-vscode'
 import type { Diagnostic, TextDocument } from 'vscode'
 import { basename } from 'node:path'
@@ -15,7 +15,7 @@ import { checkVulnerability } from './rules/vulnerability'
 export interface NodeDiagnosticInfo extends Pick<Diagnostic, 'message' | 'severity'> {
   node: ValidNode
 }
-export type DiagnosticRule = (dep: DependencyInfo, pkg: ResolvedPackument) => Awaitable<NodeDiagnosticInfo | undefined>
+export type DiagnosticRule = (dep: DependencyInfo, pkg: PackageVersionsInfoWithMetadata) => Awaitable<NodeDiagnosticInfo | undefined>
 
 const rules: DiagnosticRule[] = [
   checkDeprecation,

src/providers/diagnostics/index.ts

@@ -4,7 +4,7 @@ import { DiagnosticSeverity } from 'vscode'
 
 export const checkDeprecation: DiagnosticRule = (dep, pkg) => {
   const exactVersion = extractVersion(dep.version)
-  const versionInfo = pkg.versions[exactVersion]
+  const versionInfo = pkg.versionsMeta[exactVersion]
 
   if (!versionInfo?.deprecated)
     return

src/providers/diagnostics/rules/deprecation.ts

@@ -13,12 +13,12 @@ const DIAGNOSTIC_MAPPING: Record<Exclude<OsvSeverityLevel, 'unknown'>, Diagnosti
 
 export const checkVulnerability: DiagnosticRule = async (dep, pkg) => {
   const exactVersion = extractVersion(dep.version)
-  const versionInfo = pkg.versions[exactVersion]
+  const versionInfo = pkg.versionsMeta[exactVersion]
 
   if (!versionInfo)
     return
 
-  const { totalCounts } = await getVulnerability({ name: dep.name, version: versionInfo.version })
+  const { totalCounts } = await getVulnerability({ name: dep.name, version: exactVersion })
 
   const message: string[] = []
   let severity: DiagnosticSeverity | null = null

src/providers/diagnostics/rules/vulnerability.ts

@@ -27,10 +27,10 @@ export class NpmxHoverProvider<T extends Extractor> implements HoverProvider {
     md.isTrusted = true
 
     const pkg = await getPackageInfo(name)
-    const currentVersion = pkg.versions[coercedVersion]
+    const currentVersion = pkg.versionsMeta[coercedVersion]
     if (currentVersion) {
-      if (currentVersion.hasProvenance)
-        md.appendMarkdown(`[$(verified) Verified provenance](https://www.npmjs.com/package/${name}/v/${currentVersion.version}#provenance)\n\n`)
+      if (currentVersion.provenance)
+        md.appendMarkdown(`[$(verified) Verified provenance](https://www.npmjs.com/package/${name}/v/${version}#provenance)\n\n`)
     }
 
     const footer = [

src/providers/hover/npmx.ts

@@ -1,20 +1,8 @@
-import type { Packument, PackumentVersion } from '@npm/types'
+import type { PackageVersionsInfoWithMetadata } from 'fast-npm-meta'
 import { logger } from '#state'
-import { ofetch } from 'ofetch'
+import { getVersions } from 'fast-npm-meta'
 import { memoize } from './memoize'
 
-const NPM_REGISTRY = 'https://registry.npmjs.org'
-
-interface ResolvedPackumentVersion extends Pick<PackumentVersion, 'version'> {
-  tag?: string
-  hasProvenance: boolean
-  deprecated?: string
-}
-
-export interface ResolvedPackument {
-  versions: Record<string, ResolvedPackumentVersion>
-}
-
 /**
  * Encode a package name for use in npm registry URLs.
  * Handles scoped packages (e.g., @scope/name -> @scope%2Fname).
@@ -26,32 +14,24 @@ export function encodePackageName(name: string): string {
   return encodeURIComponent(name)
 }
 
-export const getPackageInfo = memoize<string, Promise<ResolvedPackument>>(async (name) => {
-  logger.info(`Fetching package info for ${name}`)
-  const encodedName = encodePackageName(name)
-
-  const pkg = await ofetch<Packument>(`${NPM_REGISTRY}/${encodedName}`)
-  logger.info(`Fetched package info for ${name}`)
+export interface PackageInfo extends PackageVersionsInfoWithMetadata {
+  versionToTag: Map<string, string>
+}
 
-  const resolvedVersions = Object.fromEntries(
-    Object.keys(pkg.versions)
-      .filter((v) => pkg.time[v])
-      .map<[string, ResolvedPackumentVersion]>((v) => [
-        v,
-        {
-          version: v,
-          // @ts-expect-error present if published with provenance
-          hasProvenance: !!pkg.versions[v].dist.attestations,
-          deprecated: pkg.versions[v].deprecated,
-        },
-      ]),
-  )
+export const getPackageInfo = memoize<string, Promise<PackageInfo>>(async (name) => {
+  logger.info(`Fetching package info for ${name}`)
 
-  Object.entries(pkg['dist-tags']).forEach(([tag, version]) => {
-    resolvedVersions[version].tag = tag
+  const pkg = await getVersions(name, {
+    metadata: true,
   })
+  logger.info(`Fetched package info for ${name}`)
 
-  return {
-    versions: resolvedVersions,
+  const versionToTag = new Map<string, string>()
+  if (pkg.distTags) {
+    for (const [tag, ver] of Object.entries(pkg.distTags)) {
+      versionToTag.set(ver, tag)
+    }
   }
+
+  return { ...pkg, versionToTag }
 })

src/utils/npm.ts

@@ -15,6 +15,7 @@ export default defineConfig({
     'jsonc-parser',
     'yaml',
     'ofetch',
+    'fast-npm-meta',
   ],
   minify: 'dce-only',
 })