perf: use npm-registry-fetch instead of pacote to deduce the pack…

…age size

package.json

@@ -31,7 +31,6 @@
     "@nuxt/schema": "^3.12.2",
     "@types/markdown-it": "^14.1.1",
     "@types/node": "^20.14.7",
-    "@types/pacote": "^11.1.8",
     "@types/which": "^3.0.4",
     "@types/ws": "^8.5.10",
     "@unocss/eslint-config": "^0.61.0",

packages/devtools/package.json

@@ -63,9 +63,9 @@
     "launch-editor": "^2.8.0",
     "local-pkg": "^0.5.0",
     "magicast": "^0.3.4",
+    "npm-registry-fetch": "^17.1.0",
     "nypm": "^0.3.8",
     "ohash": "^1.1.3",
-    "pacote": "^18.0.6",
     "pathe": "^1.1.2",
     "perfect-debounce": "^1.0.0",
     "pkg-types": "^1.1.1",
@@ -92,6 +92,7 @@
     "@nuxt/test-utils": "3.9.0",
     "@parcel/watcher": "^2.4.1",
     "@types/markdown-it-link-attributes": "^3.0.5",
+    "@types/npm-registry-fetch": "^8.0.7",
     "@types/ua-parser-js": "^0.7.39",
     "@unocss/nuxt": "^0.61.0",
     "@unocss/preset-icons": "^0.61.0",

packages/devtools/src/npm/index.ts

@@ -2,13 +2,36 @@ import { createRequire } from 'node:module'
 import { logger, useNuxt } from '@nuxt/kit'
 import { readPackageJSON } from 'pkg-types'
 import semver from 'semver'
+import { joinURL } from 'ufo'
 import { getPackageInfo } from 'local-pkg'
 import type { PackageUpdateInfo } from '../types'
 
 export async function getMainPackageJSON(nuxt = useNuxt()) {
   return readPackageJSON(nuxt.options.rootDir)
 }
 
+export interface Packument {
+  'name': string
+  /**
+   * An object where each key is a version, and each value is the manifest for
+   * that version.
+   */
+  'versions': Record<string, Omit<Packument, 'versions'>>
+  /**
+   * An object mapping dist-tags to version numbers. This is how `foo@latest`
+   * gets turned into `[email protected]`.
+   */
+  'dist-tags': { latest: string } & Record<string, string>
+  /**
+   * In the full packument, an object mapping version numbers to publication
+   * times, for the `opts.before` functionality.
+   */
+  'time': Record<string, string> & {
+    created: string
+    modified: string
+  }
+}
+
 export async function checkForUpdateOf(name: string, current?: string, nuxt = useNuxt()): Promise<PackageUpdateInfo | undefined> {
   try {
     if (!current) {
@@ -22,11 +45,18 @@ export async function checkForUpdateOf(name: string, current?: string, nuxt = us
     if (!current)
       return
 
-    const packument = await import('pacote').then(r => r.default?.packument || r.packument)
-    const manifest = await packument(name)
+    const { pickRegistry, json: fetchMeta } = await import('npm-registry-fetch')
+    const reg = pickRegistry(name)
+    const manifest = await fetchMeta(joinURL(reg, name), {
+      headers: {
+        'user-agent': `npm node/${process.version}`,
+        'accept': 'application/json',
+      },
+      spec: name,
+    }) as unknown as Packument
 
-    const latest = manifest['dist-tags'].latest
-    const needsUpdate = latest !== current && semver.lt(current, latest)
+    const latest = manifest?.['dist-tags']?.latest
+    const needsUpdate = !!latest && latest !== current && semver.lt(current, latest)
 
     return {
       name,