From 585e2021fc92511a08168e75db327b036dabd1de Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:10:38 +0000
Subject: [PATCH 01/28] install npmeta

---
 package.json        | 1 +
 pnpm-lock.yaml      | 9 +++++++++
 pnpm-workspace.yaml | 1 +
 3 files changed, 11 insertions(+)

diff --git a/package.json b/package.json
index 6dcc7e8801..cdb9e36036 100644
--- a/package.json
+++ b/package.json
@@ -92,6 +92,7 @@
     "ipaddr.js": "2.5.0",
     "marked": "18.0.9",
     "module-replacements": "3.3.0",
+    "npmeta": "0.1.0",
     "nuxt": "4.5.2",
     "nuxt-og-image": "6.7.8",
     "ofetch": "1.5.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d870ccfdeb..25a3e0703c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -216,6 +216,9 @@ importers:
       module-replacements:
         specifier: 3.3.0
         version: 3.3.0
+      npmeta:
+        specifier: 0.1.0
+        version: 0.1.0
       nuxt:
         specifier: 4.5.2
         version: 4.5.2(@babel/plugin-syntax-jsx@7.29.7)(@babel/plugin-syntax-typescript@7.29.7)(@oxc-project/types@0.154.0)(@parcel/watcher@2.5.6)(@rollup/plugin-babel@6.1.0)(@types/node@24.13.3)(@upstash/redis@1.38.2)(@vitejs/devtools-kit@0.4.10)(@voidzero-dev/vite-plus-core@1.3.0)(@volar/typescript@2.4.28)(@vue/compiler-sfc@3.5.42)(@vue/language-core@3.3.13)(better-sqlite3@13.0.3)(cac@7.0.0)(confbox@0.2.4)(db0@0.3.4)(dotenv@17.4.2)(encoding@0.1.13)(esbuild@0.28.1)(eslint@10.6.0)(giget@3.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.144.0)(oxlint@1.88.0)(rolldown@1.2.4)(rollup-plugin-visualizer@7.0.1)(rollup@4.62.2)(srvx@0.11.22)(supports-color@10.2.2)(terser@5.48.0)(typescript-native-bridge@6.0.3-bridge.13.tsgo.7.0.2)(vue-tsc@3.3.10)(webpack@5.108.4)(yaml@2.9.1)
@@ -8530,6 +8533,10 @@ packages:
     resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
     engines: {node: '>=18'}
 
+  npmeta@0.1.0:
+    resolution: {integrity: sha512-hHcFtHvbXV7kuffxUDZAVaMhQd5HKmDbBFx6HKK5pUju1Miv90uYSDTSO3bl5at3IlNa1ZiMriKfnaGk7lZAAA==}
+    engines: {node: '>=22'}
+
   nth-check@2.1.1:
     resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==}
 
@@ -20604,6 +20611,8 @@ snapshots:
       path-key: 4.0.0
       unicorn-magic: 0.3.0
 
+  npmeta@0.1.0: {}
+
   nth-check@2.1.1:
     dependencies:
       boolbase: 1.0.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 604576184f..7df3db102b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -51,6 +51,7 @@ minimumReleaseAgeExclude:
   - '@nuxt/schema@4.5.2'
   - '@nuxt/vite-builder@4.5.2'
   - vue-data-ui@3.28.7
+  - 'npmeta@0.1.0'
 
 minimumReleaseAgeExcludePrune: true
 

From 875dd375d8325e6b0e2bcc4dbd997facec7e2df9 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:13:55 +0000
Subject: [PATCH 02/28] chore: use `isBinaryOnlyPackage` from `npmeta`

---
 app/composables/usePackageComparison.ts       |  1 +
 app/pages/package/[[org]]/[name].vue          |  1 +
 shared/utils/binary-detection.ts              | 23 -------
 test/unit/app/utils/run-command.spec.ts       | 52 +--------------
 .../shared/utils/binary-detection.spec.ts     | 65 +------------------
 5 files changed, 4 insertions(+), 138 deletions(-)

diff --git a/app/composables/usePackageComparison.ts b/app/composables/usePackageComparison.ts
index a26e1de515..9cb7664974 100644
--- a/app/composables/usePackageComparison.ts
+++ b/app/composables/usePackageComparison.ts
@@ -1,3 +1,4 @@
+import { isBinaryOnlyPackage } from 'npmeta'
 import { parsePackageSpec } from '#shared/utils/parse-package-param'
 import { getDependencyCount } from '~/utils/npm/dependency-count'
 
diff --git a/app/pages/package/[[org]]/[name].vue b/app/pages/package/[[org]]/[name].vue
index 0ff0a66b2c..eea3b5c6f1 100644
--- a/app/pages/package/[[org]]/[name].vue
+++ b/app/pages/package/[[org]]/[name].vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { isBinaryOnlyPackage } from 'npmeta'
 import { assertValidPackageName } from '#shared/utils/npm'
 import { getDependencyCount } from '~/utils/npm/dependency-count'
 
diff --git a/shared/utils/binary-detection.ts b/shared/utils/binary-detection.ts
index 370fc8bc42..bdebdf1ecc 100644
--- a/shared/utils/binary-detection.ts
+++ b/shared/utils/binary-detection.ts
@@ -9,29 +9,6 @@ export interface PackageMetadata {
   exports?: unknown
 }
 
-/**
- * Determine if a package is "binary-only" (executable without library entry points).
- * Binary-only packages should show execute commands without install commands.
- *
- * A package is binary-only if:
- * - Name starts with "create-" (e.g., create-vite)
- * - Scoped name contains "/create-" (e.g., @vue/create-app)
- * - Has bin field but no main, module, or exports fields
- */
-export function isBinaryOnlyPackage(pkg: PackageMetadata): boolean {
-  // Check create-* patterns
-  if (isCreatePackage(pkg.name)) {
-    return true
-  }
-
-  // Has bin but no entry points
-  const hasBin =
-    pkg.bin !== undefined && (typeof pkg.bin === 'string' || Object.keys(pkg.bin).length > 0)
-  const hasEntryPoint = !!pkg.main || !!pkg.module || !!pkg.exports
-
-  return hasBin && !hasEntryPoint
-}
-
 /**
  * Check if a package uses the create-* naming convention.
  */
diff --git a/test/unit/app/utils/run-command.spec.ts b/test/unit/app/utils/run-command.spec.ts
index 9ad61feb8e..12075cd00b 100644
--- a/test/unit/app/utils/run-command.spec.ts
+++ b/test/unit/app/utils/run-command.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { getExecutableInfo, getRunCommand, getRunCommandParts } from '~/utils/run-command'
-import { isBinaryOnlyPackage, isCreatePackage } from '#shared/utils/binary-detection'
+import { isCreatePackage } from '#shared/utils/binary-detection'
 import type { JsrPackageInfo } from '#shared/types/jsr'
 
 describe('executable detection and run commands', () => {
@@ -175,56 +175,6 @@ describe('executable detection and run commands', () => {
     })
   })
 
-  describe('isBinaryOnlyPackage', () => {
-    it('returns true for create-* packages', () => {
-      expect(isBinaryOnlyPackage({ name: 'create-vite' })).toBe(true)
-      expect(isBinaryOnlyPackage({ name: 'create-next-app' })).toBe(true)
-    })
-
-    it('returns true for scoped create packages', () => {
-      expect(isBinaryOnlyPackage({ name: '@vue/create-app' })).toBe(true)
-      expect(isBinaryOnlyPackage({ name: '@scope/create-something' })).toBe(true)
-    })
-
-    it('returns true for packages with bin but no entry points', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'degit',
-          bin: { degit: './bin.js' },
-        }),
-      ).toBe(true)
-    })
-
-    it('returns false for packages with bin AND entry points', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'eslint',
-          bin: { eslint: './bin/eslint.js' },
-          main: './lib/api.js',
-        }),
-      ).toBe(false)
-    })
-
-    it('returns false for packages with exports', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'some-package',
-          bin: { cmd: './bin.js' },
-          exports: { '.': './index.js' },
-        }),
-      ).toBe(false)
-    })
-
-    it('returns false for packages without bin', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'lodash',
-          main: './lodash.js',
-        }),
-      ).toBe(false)
-    })
-  })
-
   describe('isCreatePackage', () => {
     it('returns true for create-* packages', () => {
       expect(isCreatePackage('create-vite')).toBe(true)
diff --git a/test/unit/shared/utils/binary-detection.spec.ts b/test/unit/shared/utils/binary-detection.spec.ts
index d3082c17da..57c4bf490c 100644
--- a/test/unit/shared/utils/binary-detection.spec.ts
+++ b/test/unit/shared/utils/binary-detection.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { isBinaryOnlyPackage, isCreatePackage } from '#shared/utils/binary-detection'
+import { isCreatePackage } from '#shared/utils/binary-detection'
 
 describe('binary-detection', () => {
   describe('isCreatePackage', () => {
@@ -24,67 +24,4 @@ describe('binary-detection', () => {
       expect(isCreatePackage('@scope/some-package')).toBe(false)
     })
   })
-
-  describe('isBinaryOnlyPackage', () => {
-    it('returns true for create-* packages regardless of fields', () => {
-      expect(isBinaryOnlyPackage({ name: 'create-vite' })).toBe(true)
-      expect(isBinaryOnlyPackage({ name: 'create-vite', main: './index.js' })).toBe(true)
-    })
-
-    it('returns true for scoped create-* packages', () => {
-      expect(isBinaryOnlyPackage({ name: '@lit/create-lit' })).toBe(true)
-    })
-
-    it('returns true for packages with bin but no entry points', () => {
-      expect(isBinaryOnlyPackage({ name: 'eslint', bin: './bin/eslint.js' })).toBe(true)
-      expect(
-        isBinaryOnlyPackage({
-          name: 'typescript',
-          bin: { tsc: './bin/tsc', tsserver: './bin/tsserver' },
-        }),
-      ).toBe(true)
-    })
-
-    it('returns false for packages with bin and main', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'eslint',
-          bin: './bin/eslint.js',
-          main: './lib/index.js',
-        }),
-      ).toBe(false)
-    })
-
-    it('returns false for packages with bin and module', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'some-pkg',
-          bin: './bin/cli.js',
-          module: './dist/index.mjs',
-        }),
-      ).toBe(false)
-    })
-
-    it('returns false for packages with bin and exports', () => {
-      expect(
-        isBinaryOnlyPackage({
-          name: 'some-pkg',
-          bin: './bin/cli.js',
-          exports: { '.': './dist/index.js' },
-        }),
-      ).toBe(false)
-    })
-
-    it('returns false for packages with no bin and no entry points', () => {
-      expect(isBinaryOnlyPackage({ name: 'some-pkg' })).toBe(false)
-    })
-
-    it('returns false for packages with empty bin object', () => {
-      expect(isBinaryOnlyPackage({ name: 'some-pkg', bin: {} })).toBe(false)
-    })
-
-    it('returns false for library-only packages', () => {
-      expect(isBinaryOnlyPackage({ name: 'lodash', main: './lodash.js' })).toBe(false)
-    })
-  })
 })

From a9702aad3f81fb742cacd5c4f50187738f22adf2 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:17:35 +0000
Subject: [PATCH 03/28] feat: use `parsePackageSpec` from `npmeta`

---
 app/composables/usePackageComparison.ts |  3 +-
 app/utils/parse-package-json-deps.ts    |  2 +-
 modules/runtime/server/cache.ts         |  2 +-
 shared/utils/parse-package-param.ts     | 47 -------------------------
 4 files changed, 3 insertions(+), 51 deletions(-)

diff --git a/app/composables/usePackageComparison.ts b/app/composables/usePackageComparison.ts
index 9cb7664974..0a82068dbc 100644
--- a/app/composables/usePackageComparison.ts
+++ b/app/composables/usePackageComparison.ts
@@ -1,5 +1,4 @@
-import { isBinaryOnlyPackage } from 'npmeta'
-import { parsePackageSpec } from '#shared/utils/parse-package-param'
+import { isBinaryOnlyPackage, parsePackageSpec } from 'npmeta'
 import { getDependencyCount } from '~/utils/npm/dependency-count'
 
 /** Special identifier for the "What Would James Do?" comparison column */
diff --git a/app/utils/parse-package-json-deps.ts b/app/utils/parse-package-json-deps.ts
index 68fdb0a978..637b0c60dd 100644
--- a/app/utils/parse-package-json-deps.ts
+++ b/app/utils/parse-package-json-deps.ts
@@ -1,4 +1,4 @@
-import { parsePackageSpec } from '#shared/utils/parse-package-param'
+import { parsePackageSpec } from 'npmeta'
 
 export type DependencyCategory =
   | 'dependencies'
diff --git a/modules/runtime/server/cache.ts b/modules/runtime/server/cache.ts
index 5359f75ea4..d1c331bc3b 100644
--- a/modules/runtime/server/cache.ts
+++ b/modules/runtime/server/cache.ts
@@ -1,6 +1,6 @@
 import process from 'node:process'
 import type { CachedFetchResult } from '#shared/utils/fetch-cache-config'
-import { parsePackageSpec } from '#shared/utils/parse-package-param'
+import { parsePackageSpec } from 'npmeta'
 import { createFetch } from 'ofetch'
 
 /**
diff --git a/shared/utils/parse-package-param.ts b/shared/utils/parse-package-param.ts
index 7ea86c73b8..310fcd2fd0 100644
--- a/shared/utils/parse-package-param.ts
+++ b/shared/utils/parse-package-param.ts
@@ -58,50 +58,3 @@ export function parsePackageParam(pkgParam: string): ParsedPackageParams {
     rest: [],
   }
 }
-
-/**
- * Parse a package spec into its name and optional version.
- * Handles formats like: `name`, `name@version`, `@scope/name`, `@scope/name@version`.
- *
- * The version segment may be an exact version or a dist-tag (e.g. `next`); it is
- * returned verbatim for the caller to resolve.
- *
- * @example
- * ```ts
- * parsePackageSpec('react') // { name: 'react' }
- * parsePackageSpec('react@18.2.0') // { name: 'react', version: '18.2.0' }
- * parsePackageSpec('@vue/reactivity') // { name: '@vue/reactivity' }
- * parsePackageSpec('@vue/reactivity@3.4.0') // { name: '@vue/reactivity', version: '3.4.0' }
- * ```
- */
-export function parsePackageSpec(input: string): { name: string; version?: string } {
-  if (input.startsWith('@')) {
-    // Scoped package: @scope/name or @scope/name@version
-    const slashIndex = input.indexOf('/')
-    if (slashIndex === -1) {
-      // Invalid format like just "@scope"
-      return { name: input }
-    }
-    const afterSlash = input.slice(slashIndex + 1)
-    const atIndex = afterSlash.indexOf('@')
-    if (atIndex === -1) {
-      // @scope/name (no version)
-      return { name: input }
-    }
-    // @scope/name@version
-    return {
-      name: input.slice(0, slashIndex + 1 + atIndex),
-      version: afterSlash.slice(atIndex + 1),
-    }
-  }
-
-  // Unscoped package: name or name@version
-  const atIndex = input.indexOf('@')
-  if (atIndex === -1) {
-    return { name: input }
-  }
-  return {
-    name: input.slice(0, atIndex),
-    version: input.slice(atIndex + 1),
-  }
-}

From c37a57474ff316944d86b820a40b83a5f0304b20 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:19:51 +0000
Subject: [PATCH 04/28] feat: use `splitPackageName` from `npmeta`

---
 app/composables/useCommandPalettePackageCommands.ts | 1 +
 app/composables/usePackageRoute.ts                  | 2 ++
 app/utils/package-name.ts                           | 7 -------
 app/utils/router.ts                                 | 2 +-
 4 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/app/composables/useCommandPalettePackageCommands.ts b/app/composables/useCommandPalettePackageCommands.ts
index 78ae3a62e0..3ee6e69e43 100644
--- a/app/composables/useCommandPalettePackageCommands.ts
+++ b/app/composables/useCommandPalettePackageCommands.ts
@@ -4,6 +4,7 @@ import type {
   CommandPaletteContextCommandInput,
   CommandPalettePackageContext,
 } from '~/types/command-palette'
+import { splitPackageName } from 'npmeta'
 import { downloadPackageTarball } from '~/utils/package-download'
 
 function activeLabel(isCurrentRoute: boolean, label: string) {
diff --git a/app/composables/usePackageRoute.ts b/app/composables/usePackageRoute.ts
index 238905e0e9..f28fe5e522 100644
--- a/app/composables/usePackageRoute.ts
+++ b/app/composables/usePackageRoute.ts
@@ -1,3 +1,5 @@
+import { splitPackageName } from 'npmeta'
+
 /**
  * Parse package name and optional version from the current route URL.
  *
diff --git a/app/utils/package-name.ts b/app/utils/package-name.ts
index ef0d821500..1fc4364287 100644
--- a/app/utils/package-name.ts
+++ b/app/utils/package-name.ts
@@ -2,13 +2,6 @@ import validatePackageName from 'validate-npm-package-name'
 import { NPM_REGISTRY } from '#shared/utils/constants'
 import { encodePackageName } from '#shared/utils/npm'
 
-export function splitPackageName(packageName: string): { org: string; name: string } {
-  const [org = '', name = ''] = packageName.startsWith('@')
-    ? packageName.split('/')
-    : ['', packageName]
-  return { org, name }
-}
-
 /**
  * Normalize a package name for comparison by removing common variations.
  * This aims to mirror npm's typosquatting detection algorithm.
diff --git a/app/utils/router.ts b/app/utils/router.ts
index 2ea9c0700b..9c3e1b3efe 100644
--- a/app/utils/router.ts
+++ b/app/utils/router.ts
@@ -1,5 +1,5 @@
 import type { RouteLocationRaw } from 'vue-router'
-import { splitPackageName } from '~/utils/package-name'
+import { splitPackageName } from 'npmeta'
 
 export function packageRoute(
   packageName: string,

From 701eebd366e3ce8ac5c7a7c621dfa259b821d186 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:36:36 +0000
Subject: [PATCH 05/28] feat: use `encodePackageName` from `npmeta`

---
 app/components/OgImage/Compare.takumi.vue           |  2 +-
 app/composables/npm/useNpmSearch.ts                 |  1 +
 app/composables/npm/useOrgPackages.ts               |  1 +
 app/composables/npm/usePackage.ts                   |  2 ++
 app/composables/npm/usePackageDownloads.ts          |  2 ++
 app/composables/useCharts.ts                        |  1 +
 app/composables/useDependencyAnalysis.ts            |  2 ++
 app/composables/usePackageComparison.ts             |  2 +-
 app/utils/npm/api.ts                                |  1 +
 app/utils/package-name.ts                           |  2 +-
 scripts/generate-fixtures.ts                        |  9 +--------
 server/api/changelog/info/[name]/v/[version].get.ts |  1 +
 server/api/registry/analysis/[...pkg].get.ts        |  2 +-
 server/api/registry/package-meta/[...pkg].get.ts    |  1 +
 server/utils/docs/client.ts                         |  2 +-
 server/utils/file-tree.ts                           |  1 +
 server/utils/likes-leaderboard.ts                   |  2 +-
 server/utils/npm-website-versions.ts                |  2 ++
 server/utils/npm.ts                                 |  1 +
 shared/utils/npm.ts                                 | 11 -----------
 test/unit/server/utils/npm-website-versions.spec.ts |  4 ----
 test/unit/server/utils/npm.spec.ts                  |  1 -
 22 files changed, 23 insertions(+), 30 deletions(-)

diff --git a/app/components/OgImage/Compare.takumi.vue b/app/components/OgImage/Compare.takumi.vue
index 8677507f35..65a85f17c6 100644
--- a/app/components/OgImage/Compare.takumi.vue
+++ b/app/components/OgImage/Compare.takumi.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { encodePackageName } from '#shared/utils/npm'
+import { encodePackageName } from 'npmeta'
 
 const { packages = [], emptyDescription = 'Compare npm packages side-by-side' } = defineProps<{
   packages?: string | string[]
diff --git a/app/composables/npm/useNpmSearch.ts b/app/composables/npm/useNpmSearch.ts
index e863ca3281..8025dfea0e 100644
--- a/app/composables/npm/useNpmSearch.ts
+++ b/app/composables/npm/useNpmSearch.ts
@@ -1,3 +1,4 @@
+import { encodePackageName } from 'npmeta'
 import { emptySearchResponse, metaToSearchResult } from './search-utils'
 
 interface NpmSearchOptions {
diff --git a/app/composables/npm/useOrgPackages.ts b/app/composables/npm/useOrgPackages.ts
index 5a3083f07f..138279de32 100644
--- a/app/composables/npm/useOrgPackages.ts
+++ b/app/composables/npm/useOrgPackages.ts
@@ -1,4 +1,5 @@
 import type { NpmSearchResponse, NpmSearchResult, PackageMetaResponse } from '#shared/types'
+import { encodePackageName } from 'npmeta'
 import { emptySearchResponse, metaToSearchResult } from './search-utils'
 import { mapWithConcurrency } from '#shared/utils/async'
 
diff --git a/app/composables/npm/usePackage.ts b/app/composables/npm/usePackage.ts
index 2c4a0af93f..1e24141cc7 100644
--- a/app/composables/npm/usePackage.ts
+++ b/app/composables/npm/usePackage.ts
@@ -1,3 +1,5 @@
+import { encodePackageName } from 'npmeta'
+
 export function usePackage(
   name: MaybeRefOrGetter<string>,
   requestedVersion?: MaybeRefOrGetter<string | null>,
diff --git a/app/composables/npm/usePackageDownloads.ts b/app/composables/npm/usePackageDownloads.ts
index d40321b630..3e98f277b1 100644
--- a/app/composables/npm/usePackageDownloads.ts
+++ b/app/composables/npm/usePackageDownloads.ts
@@ -1,3 +1,5 @@
+import { encodePackageName } from 'npmeta'
+
 export function usePackageDownloads(
   name: MaybeRefOrGetter<string>,
   period: MaybeRefOrGetter<'last-day' | 'last-week' | 'last-month' | 'last-year'> = 'last-week',
diff --git a/app/composables/useCharts.ts b/app/composables/useCharts.ts
index 7ee50545ee..05b08d5cab 100644
--- a/app/composables/useCharts.ts
+++ b/app/composables/useCharts.ts
@@ -9,6 +9,7 @@ import type {
 import { mapWithConcurrency } from '#shared/utils/async'
 import { splitIsoRangeIntoChunksInclusive, mergeDailyPoints } from '#shared/utils/download-ranges'
 import { fetchNpmDownloadsRange } from '~/utils/npm/api'
+import { encodePackageName } from 'npmeta'
 import { toValue } from 'vue'
 import { addDays, toIsoDate, parseIsoDate } from '~/utils/date'
 
diff --git a/app/composables/useDependencyAnalysis.ts b/app/composables/useDependencyAnalysis.ts
index 5de41ee261..27eb072a29 100644
--- a/app/composables/useDependencyAnalysis.ts
+++ b/app/composables/useDependencyAnalysis.ts
@@ -1,3 +1,5 @@
+import { encodePackageName } from 'npmeta'
+
 /**
  * Shared composable for dependency analysis data (vulnerabilities, deprecated packages).
  * Fetches once and caches the result so multiple components can use it.
diff --git a/app/composables/usePackageComparison.ts b/app/composables/usePackageComparison.ts
index 0a82068dbc..1e4eb81260 100644
--- a/app/composables/usePackageComparison.ts
+++ b/app/composables/usePackageComparison.ts
@@ -1,4 +1,4 @@
-import { isBinaryOnlyPackage, parsePackageSpec } from 'npmeta'
+import { encodePackageName, isBinaryOnlyPackage, parsePackageSpec } from 'npmeta'
 import { getDependencyCount } from '~/utils/npm/dependency-count'
 
 /** Special identifier for the "What Would James Do?" comparison column */
diff --git a/app/utils/npm/api.ts b/app/utils/npm/api.ts
index c63ffedca4..cdf2195d42 100644
--- a/app/utils/npm/api.ts
+++ b/app/utils/npm/api.ts
@@ -1,4 +1,5 @@
 import { getVersions } from 'fast-npm-meta'
+import { encodePackageName } from 'npmeta'
 import { compare } from 'verkit'
 
 type NpmDownloadsRangeResponse = {
diff --git a/app/utils/package-name.ts b/app/utils/package-name.ts
index 1fc4364287..f68089a606 100644
--- a/app/utils/package-name.ts
+++ b/app/utils/package-name.ts
@@ -1,6 +1,6 @@
+import { encodePackageName } from 'npmeta'
 import validatePackageName from 'validate-npm-package-name'
 import { NPM_REGISTRY } from '#shared/utils/constants'
-import { encodePackageName } from '#shared/utils/npm'
 
 /**
  * Normalize a package name for comparison by removing common variations.
diff --git a/scripts/generate-fixtures.ts b/scripts/generate-fixtures.ts
index 3033579417..d7e7d9d7aa 100644
--- a/scripts/generate-fixtures.ts
+++ b/scripts/generate-fixtures.ts
@@ -12,6 +12,7 @@
 
 import { writeFileSync, mkdirSync, existsSync } from 'node:fs'
 import { dirname, join } from 'node:path'
+import { encodePackageName } from 'npmeta'
 
 const FIXTURES_DIR = join(import.meta.dirname, '../test/fixtures')
 
@@ -138,14 +139,6 @@ async function fetchJson<T>(url: string): Promise<T> {
   return response.json() as Promise<T>
 }
 
-function encodePackageName(name: string): string {
-  // Encode scoped packages: @scope/name -> @scope%2Fname
-  if (name.startsWith('@')) {
-    return '@' + encodeURIComponent(name.slice(1))
-  }
-  return encodeURIComponent(name)
-}
-
 function packageToFilename(name: string): string {
   return `${name}.json`
 }
diff --git a/server/api/changelog/info/[name]/v/[version].get.ts b/server/api/changelog/info/[name]/v/[version].get.ts
index 6a2e347a98..172b78899c 100644
--- a/server/api/changelog/info/[name]/v/[version].get.ts
+++ b/server/api/changelog/info/[name]/v/[version].get.ts
@@ -1,6 +1,7 @@
 import type { ExtendedPackageJson } from '#shared/utils/package-analysis'
 import { VersionSchema, PackageNameSchema } from '#shared/schemas/package'
 import { ERROR_PACKAGE_DETECT_CHANGELOG, NPM_REGISTRY } from '#shared/utils/constants'
+import { encodePackageName } from 'npmeta'
 import * as v from 'valibot'
 import { detectChangelog } from '~~/server/utils/changelog/detectChangelog'
 
diff --git a/server/api/registry/analysis/[...pkg].get.ts b/server/api/registry/analysis/[...pkg].get.ts
index 0d44ded81a..2512f9552d 100644
--- a/server/api/registry/analysis/[...pkg].get.ts
+++ b/server/api/registry/analysis/[...pkg].get.ts
@@ -16,8 +16,8 @@ import {
   ERROR_PACKAGE_ANALYSIS_FAILED,
 } from '#shared/utils/constants'
 import { parseRepositoryInfo } from '#shared/utils/git-providers'
-import { encodePackageName } from '#shared/utils/npm'
 import { fetchPackageWithTypesAndFiles } from '#server/utils/file-tree'
+import { encodePackageName } from 'npmeta'
 import { getLatestVersionBatch } from 'fast-npm-meta'
 
 export default defineCachedEventHandler(
diff --git a/server/api/registry/package-meta/[...pkg].get.ts b/server/api/registry/package-meta/[...pkg].get.ts
index fca3910fc1..20c01685e4 100644
--- a/server/api/registry/package-meta/[...pkg].get.ts
+++ b/server/api/registry/package-meta/[...pkg].get.ts
@@ -1,3 +1,4 @@
+import { encodePackageName } from 'npmeta'
 import { normalizeLicense } from '#shared/utils/npm'
 
 /**
diff --git a/server/utils/docs/client.ts b/server/utils/docs/client.ts
index 914824b1a6..e180efd8ca 100644
--- a/server/utils/docs/client.ts
+++ b/server/utils/docs/client.ts
@@ -9,8 +9,8 @@
 
 import { doc, type DocNode } from '@deno/doc'
 import type { DenoDocNode, DenoDocResult, DocEntry } from '#shared/types/deno-doc'
+import { encodePackageName } from 'npmeta'
 import { mapWithConcurrency } from '#shared/utils/async'
-import { encodePackageName } from '#shared/utils/npm'
 import { isBuiltin } from 'node:module'
 
 // =============================================================================
diff --git a/server/utils/file-tree.ts b/server/utils/file-tree.ts
index 50e21d439c..c7039cebca 100644
--- a/server/utils/file-tree.ts
+++ b/server/utils/file-tree.ts
@@ -1,4 +1,5 @@
 import { getLatestVersion } from 'fast-npm-meta'
+import { encodePackageName } from 'npmeta'
 import { flattenFileTree } from '#server/utils/import-resolver'
 import type { ExtendedPackageJson, TypesPackageInfo } from '#shared/utils/package-analysis'
 
diff --git a/server/utils/likes-leaderboard.ts b/server/utils/likes-leaderboard.ts
index fb1a0d19f2..e2b8f43edd 100644
--- a/server/utils/likes-leaderboard.ts
+++ b/server/utils/likes-leaderboard.ts
@@ -1,4 +1,5 @@
 import type { H3Event } from 'h3'
+import { encodePackageName } from 'npmeta'
 import * as v from 'valibot'
 import type { LikesLeaderboardEntry } from '#shared/types/social'
 import type { CachedFetchFunction } from '#shared/utils/fetch-cache-config'
@@ -6,7 +7,6 @@ import { getRepositoryStars } from '#shared/utils/repository-meta'
 import { getHomepageMetadata } from '#server/utils/npm-homepage'
 import { fetchNpmPackage } from '#server/utils/npm'
 import { parseRepoUrl, type RepoRef } from '#shared/utils/git-providers'
-import { encodePackageName } from '#shared/utils/npm'
 import {
   CACHE_MAX_AGE_FIVE_MINUTES,
   CACHE_MAX_AGE_ONE_HOUR,
diff --git a/server/utils/npm-website-versions.ts b/server/utils/npm-website-versions.ts
index cc6fcf5bf8..272b9b6fd7 100644
--- a/server/utils/npm-website-versions.ts
+++ b/server/utils/npm-website-versions.ts
@@ -1,3 +1,5 @@
+import { encodePackageName } from 'npmeta'
+
 export interface NpmWebsiteVersionDownload {
   version: string
   downloads: number
diff --git a/server/utils/npm.ts b/server/utils/npm.ts
index 47da8dd452..afbe63295f 100644
--- a/server/utils/npm.ts
+++ b/server/utils/npm.ts
@@ -1,3 +1,4 @@
+import { encodePackageName } from 'npmeta'
 import { findMaxSatisfying } from 'verkit'
 
 export const fetchNpmPackage = defineCachedFunction(
diff --git a/shared/utils/npm.ts b/shared/utils/npm.ts
index f71de75a10..60de372006 100644
--- a/shared/utils/npm.ts
+++ b/shared/utils/npm.ts
@@ -3,17 +3,6 @@ import { createError } from 'h3'
 import validatePackageName from 'validate-npm-package-name'
 import type { PackumentLicense } from '#shared/types/npm-registry'
 
-/**
- * Encode package name for URL usage.
- * Scoped packages need special handling (@scope/name → @scope%2Fname)
- */
-export function encodePackageName(name: string): string {
-  if (name.startsWith('@')) {
-    return `@${encodeURIComponent(name.slice(1))}`
-  }
-  return encodeURIComponent(name)
-}
-
 /**
  * Fetch the latest version of a package using fast-npm-meta API.
  * This is a lightweight alternative to fetching the full packument.
diff --git a/test/unit/server/utils/npm-website-versions.spec.ts b/test/unit/server/utils/npm-website-versions.spec.ts
index 92e0ac7373..e69aefc0cc 100644
--- a/test/unit/server/utils/npm-website-versions.spec.ts
+++ b/test/unit/server/utils/npm-website-versions.spec.ts
@@ -1,10 +1,6 @@
 import { afterAll, afterEach, describe, expect, it, vi } from 'vitest'
 import { createError } from 'h3'
 
-vi.stubGlobal('encodePackageName', (name: string) => {
-  if (name.startsWith('@')) return `@${encodeURIComponent(name.slice(1))}`
-  return encodeURIComponent(name)
-})
 vi.stubGlobal('createError', createError)
 
 const { fetchNpmVersionDownloadsFromApi } = await import('#server/utils/npm-website-versions')
diff --git a/test/unit/server/utils/npm.spec.ts b/test/unit/server/utils/npm.spec.ts
index 1ac4ef2f16..388cc56e2e 100644
--- a/test/unit/server/utils/npm.spec.ts
+++ b/test/unit/server/utils/npm.spec.ts
@@ -4,7 +4,6 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 vi.stubGlobal('defineCachedFunction', (fn: Function) => fn)
 const $fetchMock = vi.fn()
 vi.stubGlobal('$fetch', $fetchMock)
-vi.stubGlobal('encodePackageName', (name: string) => name.replace('/', '%2F'))
 vi.stubGlobal('NPM_REGISTRY', 'https://registry.npmjs.org')
 vi.stubGlobal('CACHE_MAX_AGE_FIVE_MINUTES', 300)
 vi.stubGlobal('CACHE_MAX_AGE_ONE_DAY', 86400)

From 6a071808b63b668881af6b121102732fc2c1a873 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:41:19 +0000
Subject: [PATCH 06/28] feat: use `normalizeLicense` from `npmeta`

---
 .../api/registry/badge/[type]/[...pkg].get.ts |  3 ++-
 .../registry/license-change/[...pkg].get.ts   |  2 +-
 .../api/registry/package-meta/[...pkg].get.ts |  3 +--
 server/api/registry/timeline/[...pkg].get.ts  |  2 +-
 shared/utils/npm.ts                           | 15 ------------
 shared/utils/packument.ts                     |  2 +-
 test/unit/shared/utils/npm.spec.ts            | 23 +------------------
 7 files changed, 7 insertions(+), 43 deletions(-)

diff --git a/server/api/registry/badge/[type]/[...pkg].get.ts b/server/api/registry/badge/[type]/[...pkg].get.ts
index 4ad0e9dbd3..9b531dc592 100644
--- a/server/api/registry/badge/[type]/[...pkg].get.ts
+++ b/server/api/registry/badge/[type]/[...pkg].get.ts
@@ -1,11 +1,12 @@
 import * as v from 'valibot'
 import { createCanvas, type SKRSContext2D } from '@napi-rs/canvas'
+import { normalizeLicense } from 'npmeta'
 import { hash } from 'ohash'
 import { createError, getRouterParam, getQuery, setHeader } from 'h3'
 import { PackageRouteParamsSchema } from '#shared/schemas/package'
 import { CACHE_MAX_AGE_ONE_HOUR, ERROR_NPM_FETCH_FAILED } from '#shared/utils/constants'
 import { fetchNpmPackage } from '#server/utils/npm'
-import { assertValidPackageName, normalizeLicense } from '#shared/utils/npm'
+import { assertValidPackageName } from '#shared/utils/npm'
 import { fetchPackageWithTypesAndFiles } from '#server/utils/file-tree'
 import { handleApiError } from '#server/utils/error-handler'
 import { isExcludedByLastKnownAffectedRange } from '#server/utils/osv'
diff --git a/server/api/registry/license-change/[...pkg].get.ts b/server/api/registry/license-change/[...pkg].get.ts
index 10626f9587..7ec3433be2 100644
--- a/server/api/registry/license-change/[...pkg].get.ts
+++ b/server/api/registry/license-change/[...pkg].get.ts
@@ -1,4 +1,4 @@
-import { normalizeLicense } from '#shared/utils/npm'
+import { normalizeLicense } from 'npmeta'
 
 interface LicenseChangeRecord {
   from: string
diff --git a/server/api/registry/package-meta/[...pkg].get.ts b/server/api/registry/package-meta/[...pkg].get.ts
index 20c01685e4..46660c2c6a 100644
--- a/server/api/registry/package-meta/[...pkg].get.ts
+++ b/server/api/registry/package-meta/[...pkg].get.ts
@@ -1,5 +1,4 @@
-import { encodePackageName } from 'npmeta'
-import { normalizeLicense } from '#shared/utils/npm'
+import { encodePackageName, normalizeLicense } from 'npmeta'
 
 /**
  * Returns lightweight package metadata for search results.
diff --git a/server/api/registry/timeline/[...pkg].get.ts b/server/api/registry/timeline/[...pkg].get.ts
index 52e85dd7b8..83aef9f696 100644
--- a/server/api/registry/timeline/[...pkg].get.ts
+++ b/server/api/registry/timeline/[...pkg].get.ts
@@ -1,5 +1,5 @@
+import { normalizeLicense } from 'npmeta'
 import { compare, tryParse } from 'verkit'
-import { normalizeLicense } from '#shared/utils/npm'
 import { hasBuiltInTypes } from '~~/shared/utils/package-analysis'
 
 const DEFAULT_LIMIT = 25
diff --git a/shared/utils/npm.ts b/shared/utils/npm.ts
index 60de372006..cb28f6d6c3 100644
--- a/shared/utils/npm.ts
+++ b/shared/utils/npm.ts
@@ -1,7 +1,6 @@
 import { getLatestVersion } from 'fast-npm-meta'
 import { createError } from 'h3'
 import validatePackageName from 'validate-npm-package-name'
-import type { PackumentLicense } from '#shared/types/npm-registry'
 
 /**
  * Fetch the latest version of a package using fast-npm-meta API.
@@ -101,17 +100,3 @@ export function parseDependencyVersion(value: string): ParsedDependencyVersion {
 
   return { name: null, range: value }
 }
-
-/**
- * Normalize a packument `license` field to a plain string.
- * The field can be a string or an object with a `type` property.
- *
- * @param license Raw license value from a packument
- * @returns License string, or `undefined` if not present or unrecognized
- */
-export function normalizeLicense(license?: PackumentLicense): string | undefined {
-  if (!license) return undefined
-  if (typeof license === 'string') return license
-  if (typeof license.type === 'string') return license.type
-  return undefined
-}
diff --git a/shared/utils/packument.ts b/shared/utils/packument.ts
index d1a9dcae40..1d12901005 100644
--- a/shared/utils/packument.ts
+++ b/shared/utils/packument.ts
@@ -1,6 +1,6 @@
+import { normalizeLicense } from 'npmeta'
 import { getTrustStatus } from 'packumeta'
 import { extractInstallScriptsInfo } from '#shared/utils/install-scripts'
-import { normalizeLicense } from '#shared/utils/npm'
 import { detectSecurityDowngradeForVersion } from '~/utils/publish-security'
 import type {
   Packument,
diff --git a/test/unit/shared/utils/npm.spec.ts b/test/unit/shared/utils/npm.spec.ts
index e76bb0f743..340951335b 100644
--- a/test/unit/shared/utils/npm.spec.ts
+++ b/test/unit/shared/utils/npm.spec.ts
@@ -1,26 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { normalizeLicense, parseDependencyVersion } from '#shared/utils/npm'
-import type { PackumentLicense } from '#shared/types/npm-registry'
-
-describe('normalizeLicense', () => {
-  it('returns string licenses unchanged', () => {
-    expect(normalizeLicense('MIT')).toBe('MIT')
-  })
-
-  it('extracts type from legacy object licenses', () => {
-    expect(normalizeLicense({ type: 'Apache-2.0', url: 'https://example.com' })).toBe('Apache-2.0')
-  })
-
-  it('returns undefined for empty licenses', () => {
-    expect(normalizeLicense(undefined)).toBeUndefined()
-    expect(normalizeLicense('')).toBeUndefined()
-  })
-
-  it('returns undefined for malformed object licenses', () => {
-    expect(normalizeLicense({} as PackumentLicense)).toBeUndefined()
-    expect(normalizeLicense({ type: 123 } as unknown as PackumentLicense)).toBeUndefined()
-  })
-})
+import { parseDependencyVersion } from '#shared/utils/npm'
 
 describe('parseDependencyVersion', () => {
   it('returns plain semver ranges without a name', () => {

From d597329c27073cc0f7fbdaaab15e1521148716f8 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:43:22 +0000
Subject: [PATCH 07/28] feat: use `isCreatePackage` from `npmeta`

---
 app/pages/package/[[org]]/[name].vue          |  2 +-
 shared/utils/binary-detection.ts              | 18 -------------
 test/unit/app/utils/run-command.spec.ts       | 18 -------------
 .../shared/utils/binary-detection.spec.ts     | 27 -------------------
 4 files changed, 1 insertion(+), 64 deletions(-)
 delete mode 100644 shared/utils/binary-detection.ts
 delete mode 100644 test/unit/shared/utils/binary-detection.spec.ts

diff --git a/app/pages/package/[[org]]/[name].vue b/app/pages/package/[[org]]/[name].vue
index eea3b5c6f1..f00f335bc4 100644
--- a/app/pages/package/[[org]]/[name].vue
+++ b/app/pages/package/[[org]]/[name].vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { isBinaryOnlyPackage } from 'npmeta'
+import { isBinaryOnlyPackage, isCreatePackage } from 'npmeta'
 import { assertValidPackageName } from '#shared/utils/npm'
 import { getDependencyCount } from '~/utils/npm/dependency-count'
 
diff --git a/shared/utils/binary-detection.ts b/shared/utils/binary-detection.ts
deleted file mode 100644
index bdebdf1ecc..0000000000
--- a/shared/utils/binary-detection.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/**
- * Metadata needed to determine if a package is binary-only.
- */
-export interface PackageMetadata {
-  name: string
-  bin?: string | Record<string, string>
-  main?: string
-  module?: unknown
-  exports?: unknown
-}
-
-/**
- * Check if a package uses the create-* naming convention.
- */
-export function isCreatePackage(packageName: string): boolean {
-  const baseName = packageName.startsWith('@') ? packageName.split('/')[1] : packageName
-  return baseName?.startsWith('create-') || packageName.includes('/create-') || false
-}
diff --git a/test/unit/app/utils/run-command.spec.ts b/test/unit/app/utils/run-command.spec.ts
index 12075cd00b..62df44f322 100644
--- a/test/unit/app/utils/run-command.spec.ts
+++ b/test/unit/app/utils/run-command.spec.ts
@@ -1,6 +1,5 @@
 import { describe, expect, it } from 'vitest'
 import { getExecutableInfo, getRunCommand, getRunCommandParts } from '~/utils/run-command'
-import { isCreatePackage } from '#shared/utils/binary-detection'
 import type { JsrPackageInfo } from '#shared/types/jsr'
 
 describe('executable detection and run commands', () => {
@@ -174,21 +173,4 @@ describe('executable detection and run commands', () => {
       expect(parts.join(' ')).toBe(command)
     })
   })
-
-  describe('isCreatePackage', () => {
-    it('returns true for create-* packages', () => {
-      expect(isCreatePackage('create-vite')).toBe(true)
-      expect(isCreatePackage('create-next-app')).toBe(true)
-    })
-
-    it('returns true for scoped create packages', () => {
-      expect(isCreatePackage('@vue/create-app')).toBe(true)
-    })
-
-    it('returns false for regular packages', () => {
-      expect(isCreatePackage('eslint')).toBe(false)
-      expect(isCreatePackage('lodash')).toBe(false)
-      expect(isCreatePackage('@scope/utils')).toBe(false)
-    })
-  })
 })
diff --git a/test/unit/shared/utils/binary-detection.spec.ts b/test/unit/shared/utils/binary-detection.spec.ts
deleted file mode 100644
index 57c4bf490c..0000000000
--- a/test/unit/shared/utils/binary-detection.spec.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { isCreatePackage } from '#shared/utils/binary-detection'
-
-describe('binary-detection', () => {
-  describe('isCreatePackage', () => {
-    it('returns true for create-* packages', () => {
-      expect(isCreatePackage('create-vite')).toBe(true)
-      expect(isCreatePackage('create-svelte-app')).toBe(true)
-      expect(isCreatePackage('create-lit-app')).toBe(true)
-    })
-
-    it('returns true for scoped create-* packages', () => {
-      expect(isCreatePackage('@lit/create-lit')).toBe(true)
-      expect(isCreatePackage('@scope/create-something')).toBe(true)
-    })
-
-    it('returns false for non-create packages', () => {
-      expect(isCreatePackage('vite')).toBe(false)
-      expect(isCreatePackage('lit')).toBe(false)
-      expect(isCreatePackage('my-create-tool')).toBe(false)
-    })
-
-    it('returns false for scoped non-create packages', () => {
-      expect(isCreatePackage('@scope/some-package')).toBe(false)
-    })
-  })
-})

From 4be8d80fddae35f47ec787238ed14695aaf9c29a Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:45:27 +0000
Subject: [PATCH 08/28] feat: use `getTypesPackageName` from `npmeta`

---
 server/utils/file-tree.ts                       |  2 +-
 shared/utils/package-analysis.ts                | 11 -----------
 test/unit/shared/utils/package-analysis.spec.ts | 11 -----------
 3 files changed, 1 insertion(+), 23 deletions(-)

diff --git a/server/utils/file-tree.ts b/server/utils/file-tree.ts
index c7039cebca..19f5ec4214 100644
--- a/server/utils/file-tree.ts
+++ b/server/utils/file-tree.ts
@@ -1,5 +1,5 @@
 import { getLatestVersion } from 'fast-npm-meta'
-import { encodePackageName } from 'npmeta'
+import { encodePackageName, getTypesPackageName } from 'npmeta'
 import { flattenFileTree } from '#server/utils/import-resolver'
 import type { ExtendedPackageJson, TypesPackageInfo } from '#shared/utils/package-analysis'
 
diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index 67152914bf..dd533ecfa8 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -388,17 +388,6 @@ export function hasBuiltInTypes(pkg: ExtendedPackageJson): boolean {
   return false
 }
 
-/**
- * Get the @types package name for a given package
- */
-export function getTypesPackageName(packageName: string): string {
-  if (packageName.startsWith('@')) {
-    // Scoped package: @scope/name -> @types/scope__name
-    return `@types/${packageName.slice(1).replace('/', '__')}`
-  }
-  return `@types/${packageName}`
-}
-
 /**
  * Options for package analysis
  */
diff --git a/test/unit/shared/utils/package-analysis.spec.ts b/test/unit/shared/utils/package-analysis.spec.ts
index dced5ae925..52fc0fca98 100644
--- a/test/unit/shared/utils/package-analysis.spec.ts
+++ b/test/unit/shared/utils/package-analysis.spec.ts
@@ -5,7 +5,6 @@ import {
   detectTypesStatus,
   getCreatePackageName,
   getCreateShortName,
-  getTypesPackageName,
   hasBuiltInTypes,
 } from '#shared/utils/package-analysis'
 
@@ -351,16 +350,6 @@ describe('analyzePackage with files (implicit types)', () => {
   })
 })
 
-describe('getTypesPackageName', () => {
-  it('handles unscoped package', () => {
-    expect(getTypesPackageName('lodash')).toBe('@types/lodash')
-  })
-
-  it('handles scoped package', () => {
-    expect(getTypesPackageName('@nuxt/kit')).toBe('@types/nuxt__kit')
-  })
-})
-
 describe('hasBuiltInTypes', () => {
   it('returns true when types field is present', () => {
     expect(hasBuiltInTypes({ types: './index.d.ts' })).toBe(true)

From 2358b6ef807d2b6dc14335c364f3e42922bbe779 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:48:49 +0000
Subject: [PATCH 09/28] feat: use `parseDependencyVersion` from `npmeta`

---
 app/components/Package/Dependencies.vue       |  2 +-
 .../npm/useOutdatedDependencies.ts            |  2 +-
 .../npm/useReplacementDependencies.ts         |  2 +-
 shared/utils/npm.ts                           | 66 -------------------
 test/unit/shared/utils/npm.spec.ts            | 56 ----------------
 5 files changed, 3 insertions(+), 125 deletions(-)
 delete mode 100644 test/unit/shared/utils/npm.spec.ts

diff --git a/app/components/Package/Dependencies.vue b/app/components/Package/Dependencies.vue
index 35657daadb..6ec0804632 100644
--- a/app/components/Package/Dependencies.vue
+++ b/app/components/Package/Dependencies.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { parseDependencyVersion } from '#shared/utils/npm'
+import { parseDependencyVersion } from 'npmeta'
 import { SEVERITY_TEXT_COLORS, getHighestSeverity } from '#shared/utils/severity'
 import { getOutdatedTooltip, getVersionClass } from '~/utils/npm/outdated-dependencies'
 
diff --git a/app/composables/npm/useOutdatedDependencies.ts b/app/composables/npm/useOutdatedDependencies.ts
index c59891a7bb..8bb3542d39 100644
--- a/app/composables/npm/useOutdatedDependencies.ts
+++ b/app/composables/npm/useOutdatedDependencies.ts
@@ -1,7 +1,7 @@
 import type { PackageVersionsInfo } from 'fast-npm-meta'
 import { getVersionsBatch } from 'fast-npm-meta'
+import { parseDependencyVersion } from 'npmeta'
 import { difference, findMaxSatisfying, getMajor, getMinor, isGreater, isStable } from 'verkit'
-import { parseDependencyVersion } from '#shared/utils/npm'
 import {
   type OutdatedDependencyInfo,
   constraintIncludesPrerelease,
diff --git a/app/composables/npm/useReplacementDependencies.ts b/app/composables/npm/useReplacementDependencies.ts
index b362556c2e..d53bfb19d0 100644
--- a/app/composables/npm/useReplacementDependencies.ts
+++ b/app/composables/npm/useReplacementDependencies.ts
@@ -1,5 +1,5 @@
 import type { ModuleReplacement, ModuleReplacementMapping } from 'module-replacements'
-import { parseDependencyVersion } from '#shared/utils/npm'
+import { parseDependencyVersion } from 'npmeta'
 
 async function fetchReplacements(
   deps: Record<string, string>,
diff --git a/shared/utils/npm.ts b/shared/utils/npm.ts
index cb28f6d6c3..44a88ad400 100644
--- a/shared/utils/npm.ts
+++ b/shared/utils/npm.ts
@@ -34,69 +34,3 @@ export function assertValidPackageName(name: string): void {
     })
   }
 }
-
-/** Parsed result of an npm dependency version value */
-export interface ParsedDependencyVersion {
-  /** The real package name (different from the dependency key only for aliases) */
-  name: string | null
-  /** The semver range or version, null for non-resolvable values (file:, git, etc.) */
-  range: string | null
-}
-
-/** Git references, e.g. `git://`, `git+ssh://`, `git+https://`, `github:user/repo` */
-const GIT_REFERENCE_RE = /^(?:git(?:\+(?:ssh|https?|file))?:|github:)/
-/** Tarball URLs, e.g. `https://example.com/pkg.tgz` */
-const HTTP_REFERENCE_RE = /^https?:\/\//
-
-/**
- * Check if a constraint is a non-semver value (git URL, file path, etc.)
- *
- * Matches protocols rather than bare prefixes so that dist-tags which happen to
- * start with them (`git`, `github`, `http`) are still treated as resolvable.
- */
-function isNonSemverConstraint(constraint: string): boolean {
-  return (
-    GIT_REFERENCE_RE.test(constraint) ||
-    HTTP_REFERENCE_RE.test(constraint) ||
-    constraint.startsWith('file:') ||
-    constraint.startsWith('link:') ||
-    constraint.startsWith('workspace:') ||
-    constraint.includes('/')
-  )
-}
-
-/**
- * Parse a dependency version value, which may be a semver range, an npm alias,
- * or a non-semver reference.
- *
- * Examples:
- *   "^4.2.0"                    { name: null, range: "^4.2.0" }
- *   "npm:string-width@^4.2.0"   { name: "string-width", range: "^4.2.0" }
- *   "npm:@scope/pkg@^1.0.0"     { name: "@scope/pkg", range: "^1.0.0" }
- *   "file:../foo"               { name: null, range: null }
- */
-export function parseDependencyVersion(value: string): ParsedDependencyVersion {
-  if (value.startsWith('npm:')) {
-    const aliasBody = value.slice(4) // strip "npm:"
-    // Scoped: @scope/name@range
-    if (aliasBody.startsWith('@')) {
-      const secondAt = aliasBody.indexOf('@', 1)
-      if (secondAt !== -1) {
-        return { name: aliasBody.slice(0, secondAt), range: aliasBody.slice(secondAt + 1) }
-      }
-      return { name: aliasBody, range: null }
-    }
-    // Unscoped: name@range
-    const atIndex = aliasBody.indexOf('@')
-    if (atIndex !== -1) {
-      return { name: aliasBody.slice(0, atIndex), range: aliasBody.slice(atIndex + 1) }
-    }
-    return { name: aliasBody, range: null }
-  }
-
-  if (isNonSemverConstraint(value)) {
-    return { name: null, range: null }
-  }
-
-  return { name: null, range: value }
-}
diff --git a/test/unit/shared/utils/npm.spec.ts b/test/unit/shared/utils/npm.spec.ts
deleted file mode 100644
index 340951335b..0000000000
--- a/test/unit/shared/utils/npm.spec.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { parseDependencyVersion } from '#shared/utils/npm'
-
-describe('parseDependencyVersion', () => {
-  it('returns plain semver ranges without a name', () => {
-    expect(parseDependencyVersion('^4.2.0')).toEqual({ name: null, range: '^4.2.0' })
-    expect(parseDependencyVersion('1.0.0')).toEqual({ name: null, range: '1.0.0' })
-    expect(parseDependencyVersion('*')).toEqual({ name: null, range: '*' })
-    expect(parseDependencyVersion('latest')).toEqual({ name: null, range: 'latest' })
-  })
-
-  it('resolves unscoped npm: aliases', () => {
-    expect(parseDependencyVersion('npm:string-width@^4.2.0')).toEqual({
-      name: 'string-width',
-      range: '^4.2.0',
-    })
-  })
-
-  it('resolves scoped npm: aliases', () => {
-    expect(parseDependencyVersion('npm:@scope/pkg@^1.0.0')).toEqual({
-      name: '@scope/pkg',
-      range: '^1.0.0',
-    })
-  })
-
-  it('resolves npm: aliases without a range', () => {
-    expect(parseDependencyVersion('npm:string-width')).toEqual({
-      name: 'string-width',
-      range: null,
-    })
-    expect(parseDependencyVersion('npm:@scope/pkg')).toEqual({ name: '@scope/pkg', range: null })
-  })
-
-  it('returns nothing resolvable for non-semver references', () => {
-    for (const value of [
-      'file:../foo',
-      'link:../foo',
-      'workspace:*',
-      'git://github.com/user/repo.git',
-      'git+ssh://git@github.com/user/repo.git',
-      'git+https://github.com/user/repo.git',
-      'github:user/repo',
-      'http://example.com/pkg.tgz',
-      'https://example.com/pkg.tgz',
-      'user/repo',
-    ]) {
-      expect(parseDependencyVersion(value)).toEqual({ name: null, range: null })
-    }
-  })
-
-  it('treats dist-tags that look like protocols as resolvable', () => {
-    for (const tag of ['git', 'github', 'gitlab', 'http', 'https', 'file', 'next']) {
-      expect(parseDependencyVersion(tag)).toEqual({ name: null, range: tag })
-    }
-  })
-})

From 5c70ed0fdec997a5a45ac7c871cf04fa8bb73d5c Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:52:27 +0000
Subject: [PATCH 10/28] feat: use `getCreateShortName` and
 `getCreatePackageName` from `npmeta`

---
 app/utils/install-command.ts                  |  2 +-
 server/api/registry/analysis/[...pkg].get.ts  |  4 +-
 shared/utils/package-analysis.ts              | 40 ----------------
 .../shared/utils/package-analysis.spec.ts     | 46 -------------------
 4 files changed, 3 insertions(+), 89 deletions(-)

diff --git a/app/utils/install-command.ts b/app/utils/install-command.ts
index 3547bc8ebd..ada658a785 100644
--- a/app/utils/install-command.ts
+++ b/app/utils/install-command.ts
@@ -1,5 +1,5 @@
 import type { JsrPackageInfo } from '#shared/types/jsr'
-import { getCreateShortName } from '#shared/utils/package-analysis'
+import { getCreateShortName } from 'npmeta'
 
 // @unocss-include
 export const packageManagers = [
diff --git a/server/api/registry/analysis/[...pkg].get.ts b/server/api/registry/analysis/[...pkg].get.ts
index 2512f9552d..766fde147b 100644
--- a/server/api/registry/analysis/[...pkg].get.ts
+++ b/server/api/registry/analysis/[...pkg].get.ts
@@ -5,7 +5,7 @@ import type {
   ExtendedPackageJson,
   CreatePackageInfo,
 } from '#shared/utils/package-analysis'
-import { analyzePackage, getCreatePackageName } from '#shared/utils/package-analysis'
+import { analyzePackage } from '#shared/utils/package-analysis'
 import {
   getDevDependencySuggestion,
   type DevDependencySuggestion,
@@ -17,7 +17,7 @@ import {
 } from '#shared/utils/constants'
 import { parseRepositoryInfo } from '#shared/utils/git-providers'
 import { fetchPackageWithTypesAndFiles } from '#server/utils/file-tree'
-import { encodePackageName } from 'npmeta'
+import { encodePackageName, getCreatePackageName } from 'npmeta'
 import { getLatestVersionBatch } from 'fast-npm-meta'
 
 export default defineCachedEventHandler(
diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index dd533ecfa8..2e0424c7f9 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -209,46 +209,6 @@ interface RelatedPackageInfo {
 export type TypesPackageInfo = RelatedPackageInfo
 export type CreatePackageInfo = RelatedPackageInfo
 
-/**
- * Get the create-* package name for a given package.
- * e.g., "vite" -> "create-vite", "@scope/foo" -> "@scope/create-foo"
- */
-export function getCreatePackageName(packageName: string): string {
-  if (packageName.startsWith('@')) {
-    // Scoped package: @scope/name -> @scope/create-name
-    const slashIndex = packageName.indexOf('/')
-    const scope = packageName.slice(0, slashIndex)
-    const name = packageName.slice(slashIndex + 1)
-    return `${scope}/create-${name}`
-  }
-  return `create-${packageName}`
-}
-
-/**
- * Extract the short name from a create-* package for display.
- * e.g., "create-vite" -> "vite", "@scope/create-foo" -> "@scope/foo", "@scope/create" -> "@scope"
- */
-export function getCreateShortName(createPackageName: string): string {
-  if (createPackageName.startsWith('@')) {
-    // @scope/create -> @scope, @scope/create-foo -> @scope/foo
-    const slashIndex = createPackageName.indexOf('/')
-    const scope = createPackageName.slice(0, slashIndex)
-    const name = createPackageName.slice(slashIndex + 1)
-    if (name === 'create') {
-      return scope
-    }
-    if (name.startsWith('create-')) {
-      return `${scope}/${name.slice('create-'.length)}`
-    }
-    return createPackageName
-  }
-  // create-vite -> vite
-  if (createPackageName.startsWith('create-')) {
-    return createPackageName.slice('create-'.length)
-  }
-  return createPackageName
-}
-
 /**
  * Map of JS extensions to their corresponding declaration file extensions.
  */
diff --git a/test/unit/shared/utils/package-analysis.spec.ts b/test/unit/shared/utils/package-analysis.spec.ts
index 52fc0fca98..13017eeba0 100644
--- a/test/unit/shared/utils/package-analysis.spec.ts
+++ b/test/unit/shared/utils/package-analysis.spec.ts
@@ -3,8 +3,6 @@ import {
   analyzePackage,
   detectModuleFormat,
   detectTypesStatus,
-  getCreatePackageName,
-  getCreateShortName,
   hasBuiltInTypes,
 } from '#shared/utils/package-analysis'
 
@@ -476,47 +474,3 @@ describe('analyzePackage', () => {
     })
   })
 })
-
-describe('getCreatePackageName', () => {
-  it('handles unscoped package', () => {
-    expect(getCreatePackageName('vite')).toBe('create-vite')
-  })
-
-  it('handles scoped package', () => {
-    expect(getCreatePackageName('@nuxt/app')).toBe('@nuxt/create-app')
-  })
-
-  it('handles single-word package', () => {
-    expect(getCreatePackageName('next')).toBe('create-next')
-  })
-
-  it('handles hyphenated package', () => {
-    expect(getCreatePackageName('solid-js')).toBe('create-solid-js')
-  })
-})
-
-describe('getCreateShortName', () => {
-  it('extracts name from unscoped create-* package', () => {
-    expect(getCreateShortName('create-vite')).toBe('vite')
-  })
-
-  it('extracts name from scoped create-* package preserving scope', () => {
-    expect(getCreateShortName('@vue/create-app')).toBe('@vue/app')
-  })
-
-  it('returns full name if not a create-* package', () => {
-    expect(getCreateShortName('vite')).toBe('vite')
-  })
-
-  it('returns full name for scoped package without create- prefix', () => {
-    expect(getCreateShortName('@scope/foo')).toBe('@scope/foo')
-  })
-
-  it('extracts name from create-next-app style packages', () => {
-    expect(getCreateShortName('create-next-app')).toBe('next-app')
-  })
-
-  it('returns scope only for @scope/create packages', () => {
-    expect(getCreateShortName('@angular/create')).toBe('@angular')
-  })
-})

From caaff3f563819118e421f58b30187c70c8d26316 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 11:55:16 +0000
Subject: [PATCH 11/28] feat: use `hasBuiltInTypes` from `npmeta`

---
 .../api/registry/badge/[type]/[...pkg].get.ts |  2 +-
 server/api/registry/timeline/[...pkg].get.ts  | 12 ++-----
 server/utils/file-tree.ts                     |  2 +-
 .../shared/utils/package-analysis.spec.ts     | 32 -------------------
 4 files changed, 5 insertions(+), 43 deletions(-)

diff --git a/server/api/registry/badge/[type]/[...pkg].get.ts b/server/api/registry/badge/[type]/[...pkg].get.ts
index 9b531dc592..83bfcfbf86 100644
--- a/server/api/registry/badge/[type]/[...pkg].get.ts
+++ b/server/api/registry/badge/[type]/[...pkg].get.ts
@@ -1,6 +1,6 @@
 import * as v from 'valibot'
 import { createCanvas, type SKRSContext2D } from '@napi-rs/canvas'
-import { normalizeLicense } from 'npmeta'
+import { hasBuiltInTypes, normalizeLicense } from 'npmeta'
 import { hash } from 'ohash'
 import { createError, getRouterParam, getQuery, setHeader } from 'h3'
 import { PackageRouteParamsSchema } from '#shared/schemas/package'
diff --git a/server/api/registry/timeline/[...pkg].get.ts b/server/api/registry/timeline/[...pkg].get.ts
index 83aef9f696..6646d07716 100644
--- a/server/api/registry/timeline/[...pkg].get.ts
+++ b/server/api/registry/timeline/[...pkg].get.ts
@@ -1,6 +1,5 @@
-import { normalizeLicense } from 'npmeta'
-import { compare, tryParse } from 'verkit'
-import { hasBuiltInTypes } from '~~/shared/utils/package-analysis'
+import { hasBuiltInTypes, normalizeLicense } from 'npmeta'
+import { compare, isStable } from 'verkit'
 
 const DEFAULT_LIMIT = 25
 
@@ -14,11 +13,6 @@ export function parseStableOnly(value: unknown): boolean {
   return value === 'true'
 }
 
-export function isStableVersion(version: string): boolean {
-  const parsed = tryParse(version)
-  return !!parsed && (parsed.prerelease?.length ?? 0) === 0
-}
-
 export interface TimelineVersion {
   version: string
   time: string
@@ -87,7 +81,7 @@ export default defineCachedEventHandler(
 
       // Build full sorted list
       const allVersions = Object.keys(packument.versions).filter(
-        v => packument.time[v] && (!stableOnly || isStableVersion(v)),
+        v => packument.time[v] && (!stableOnly || isStable(v)),
       )
 
       if (sort === 'semver') {
diff --git a/server/utils/file-tree.ts b/server/utils/file-tree.ts
index 19f5ec4214..9e47efdcca 100644
--- a/server/utils/file-tree.ts
+++ b/server/utils/file-tree.ts
@@ -1,5 +1,5 @@
 import { getLatestVersion } from 'fast-npm-meta'
-import { encodePackageName, getTypesPackageName } from 'npmeta'
+import { encodePackageName, getTypesPackageName, hasBuiltInTypes } from 'npmeta'
 import { flattenFileTree } from '#server/utils/import-resolver'
 import type { ExtendedPackageJson, TypesPackageInfo } from '#shared/utils/package-analysis'
 
diff --git a/test/unit/shared/utils/package-analysis.spec.ts b/test/unit/shared/utils/package-analysis.spec.ts
index 13017eeba0..e73b240d14 100644
--- a/test/unit/shared/utils/package-analysis.spec.ts
+++ b/test/unit/shared/utils/package-analysis.spec.ts
@@ -3,7 +3,6 @@ import {
   analyzePackage,
   detectModuleFormat,
   detectTypesStatus,
-  hasBuiltInTypes,
 } from '#shared/utils/package-analysis'
 
 describe('detectModuleFormat', () => {
@@ -348,37 +347,6 @@ describe('analyzePackage with files (implicit types)', () => {
   })
 })
 
-describe('hasBuiltInTypes', () => {
-  it('returns true when types field is present', () => {
-    expect(hasBuiltInTypes({ types: './index.d.ts' })).toBe(true)
-  })
-
-  it('returns true when typings field is present', () => {
-    expect(hasBuiltInTypes({ typings: './index.d.ts' })).toBe(true)
-  })
-
-  it('returns true when exports has types condition', () => {
-    expect(
-      hasBuiltInTypes({
-        exports: {
-          '.': {
-            types: './index.d.ts',
-            default: './index.js',
-          },
-        },
-      }),
-    ).toBe(true)
-  })
-
-  it('returns false when no types are present', () => {
-    expect(hasBuiltInTypes({ main: 'index.js' })).toBe(false)
-  })
-
-  it('returns false for empty package', () => {
-    expect(hasBuiltInTypes({})).toBe(false)
-  })
-})
-
 describe('analyzePackage', () => {
   it('analyzes Vue package correctly', () => {
     const result = analyzePackage({

From a5adefabfad8a34c339a7f6e7519db89d854ea53 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 12:04:52 +0000
Subject: [PATCH 12/28] fix: use `isStable` from `verkit`

---
 server/api/registry/timeline/sizes/[...pkg].get.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/server/api/registry/timeline/sizes/[...pkg].get.ts b/server/api/registry/timeline/sizes/[...pkg].get.ts
index c7c45da17d..6340f048d4 100644
--- a/server/api/registry/timeline/sizes/[...pkg].get.ts
+++ b/server/api/registry/timeline/sizes/[...pkg].get.ts
@@ -1,9 +1,8 @@
 import { getVersions } from 'fast-npm-meta'
-import { compare } from 'verkit'
+import { compare, isStable } from 'verkit'
 import {
   parseTimelineSort,
   parseStableOnly,
-  isStableVersion,
 } from '~~/server/api/registry/timeline/[...pkg].get'
 
 const DEFAULT_LIMIT = 25
@@ -69,7 +68,7 @@ export default defineCachedEventHandler(
 
       // Must mirror the timeline endpoint's ordering so a given offset/limit page
       // covers the same versions the client is displaying.
-      const allVersions = versions.filter(v => time[v] && (!stableOnly || isStableVersion(v)))
+      const allVersions = versions.filter(v => time[v] && (!stableOnly || isStable(v)))
 
       if (sort === 'semver') {
         allVersions.sort((a, b) => compare(b, a))

From 45de4141dd23cd7b8e230f7f2ad4b7280cf816f3 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:06:07 +0000
Subject: [PATCH 13/28] [autofix.ci] apply automated fixes

---
 server/api/registry/timeline/sizes/[...pkg].get.ts | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/server/api/registry/timeline/sizes/[...pkg].get.ts b/server/api/registry/timeline/sizes/[...pkg].get.ts
index 6340f048d4..fc57db3f0e 100644
--- a/server/api/registry/timeline/sizes/[...pkg].get.ts
+++ b/server/api/registry/timeline/sizes/[...pkg].get.ts
@@ -1,9 +1,6 @@
 import { getVersions } from 'fast-npm-meta'
 import { compare, isStable } from 'verkit'
-import {
-  parseTimelineSort,
-  parseStableOnly,
-} from '~~/server/api/registry/timeline/[...pkg].get'
+import { parseTimelineSort, parseStableOnly } from '~~/server/api/registry/timeline/[...pkg].get'
 
 const DEFAULT_LIMIT = 25
 

From 013c0817de787ce56901bc337fb14e6080added2 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 12:09:18 +0000
Subject: [PATCH 14/28] feat: use `detectModuleFormat` from `npmeta`

---
 shared/utils/package-analysis.ts              |  67 +-----
 .../shared/utils/package-analysis.spec.ts     | 198 ------------------
 2 files changed, 4 insertions(+), 261 deletions(-)

diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index 2e0424c7f9..15a85b3b75 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -1,8 +1,11 @@
+import { detectModuleFormat } from 'npmeta'
+
 /**
  * Package analysis utilities for detecting module format and TypeScript support
  */
 
-export type ModuleFormat = 'esm' | 'cjs' | 'dual' | 'wasm' | 'unknown'
+// TODO(Roman): replace once exported from `npmeta`
+export type ModuleFormat = ReturnType<typeof detectModuleFormat>
 
 export type TypesStatus =
   | { kind: 'included' }
@@ -42,68 +45,6 @@ export interface ExtendedPackageJson {
 
 type PackageExports = string | null | { [key: string]: PackageExports } | PackageExports[]
 
-/**
- * Detect the module format of a package based on package.json fields
- */
-export function detectModuleFormat(pkg: ExtendedPackageJson): ModuleFormat {
-  const hasExports = pkg.exports != null
-  const hasModule = !!pkg.module
-  const hasMain = !!pkg.main
-  const isTypeModule = pkg.type === 'module'
-  const isTypeCommonjs = pkg.type === 'commonjs' || !pkg.type
-
-  // Check exports field for dual format indicators
-  if (hasExports && pkg.exports) {
-    const exportInfo = analyzeExports(pkg.exports, isTypeModule)
-
-    if (exportInfo.hasImport && exportInfo.hasRequire) {
-      return 'dual'
-    }
-
-    if (exportInfo.hasImport || exportInfo.hasModule) {
-      // Has ESM exports, check if also has CJS
-      if (hasMain && !isTypeModule) {
-        return 'dual'
-      }
-      return 'esm'
-    }
-
-    if (exportInfo.hasRequire) {
-      // Has CJS exports, check if also has ESM
-      if (hasModule) {
-        return 'dual'
-      }
-      return 'cjs'
-    }
-
-    // exports field exists but doesn't use import/require conditions
-    // Fall through to other detection methods
-  }
-
-  // Legacy detection without exports field
-  if (hasModule && hasMain) {
-    // Check for dual packages (has module field and main points to cjs)
-    const mainIsCJS = pkg.main?.endsWith('.cjs') || (pkg.main?.endsWith('.js') && !isTypeModule)
-
-    return mainIsCJS ? 'dual' : 'esm'
-  }
-
-  const mainIsWASM = pkg.main?.endsWith('.wasm')
-  if (mainIsWASM) {
-    return 'wasm'
-  }
-
-  if (hasModule || isTypeModule) {
-    return 'esm'
-  }
-
-  if (hasMain || isTypeCommonjs) {
-    return 'cjs'
-  }
-
-  return 'unknown'
-}
-
 interface ExportsAnalysis {
   hasImport: boolean
   hasRequire: boolean
diff --git a/test/unit/shared/utils/package-analysis.spec.ts b/test/unit/shared/utils/package-analysis.spec.ts
index e73b240d14..0916dd13b3 100644
--- a/test/unit/shared/utils/package-analysis.spec.ts
+++ b/test/unit/shared/utils/package-analysis.spec.ts
@@ -1,207 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import {
   analyzePackage,
-  detectModuleFormat,
   detectTypesStatus,
 } from '#shared/utils/package-analysis'
 
-describe('detectModuleFormat', () => {
-  it('detects ESM from type: module', () => {
-    expect(detectModuleFormat({ type: 'module', main: 'index.js' })).toBe('esm')
-  })
-
-  it('detects CJS from type: commonjs', () => {
-    expect(detectModuleFormat({ type: 'commonjs', main: 'index.js' })).toBe('cjs')
-  })
-
-  it('detects CJS when no type field (default)', () => {
-    expect(detectModuleFormat({ main: 'index.js' })).toBe('cjs')
-  })
-
-  it('detects dual from module + main fields', () => {
-    expect(detectModuleFormat({ module: 'index.mjs', main: 'index.js' })).toBe('dual')
-  })
-
-  it('detects dual from type + module + main fields', () => {
-    expect(detectModuleFormat({ type: 'module', module: 'index.js', main: 'index.cjs' })).toBe(
-      'dual',
-    )
-  })
-
-  it('detects esm from type + module + main fields', () => {
-    expect(detectModuleFormat({ type: 'module', module: 'index.js', main: 'index.js' })).toBe('esm')
-  })
-
-  it('detects ESM from module field without main', () => {
-    expect(detectModuleFormat({ module: 'index.mjs' })).toBe('esm')
-  })
-
-  it('detects dual from exports with import + require conditions', () => {
-    expect(
-      detectModuleFormat({
-        exports: {
-          '.': {
-            import: './index.mjs',
-            require: './index.cjs',
-          },
-        },
-      }),
-    ).toBe('dual')
-  })
-
-  it('detects ESM from exports with only import condition', () => {
-    expect(
-      detectModuleFormat({
-        type: 'module',
-        exports: {
-          '.': {
-            import: './index.js',
-          },
-        },
-      }),
-    ).toBe('esm')
-  })
-
-  it('detects CJS from exports with only require condition', () => {
-    expect(
-      detectModuleFormat({
-        exports: {
-          '.': {
-            require: './index.cjs',
-          },
-        },
-      }),
-    ).toBe('cjs')
-  })
-
-  it('detects dual from nested exports with both conditions', () => {
-    expect(
-      detectModuleFormat({
-        exports: {
-          '.': {
-            import: {
-              types: './dist/index.d.mts',
-              default: './dist/index.mjs',
-            },
-            require: {
-              types: './dist/index.d.ts',
-              default: './dist/index.cjs',
-            },
-          },
-        },
-      }),
-    ).toBe('dual')
-  })
-
-  it('returns cjs for empty package (npm default)', () => {
-    // npm treats packages without type field as CommonJS
-    expect(detectModuleFormat({})).toBe('cjs')
-  })
-
-  it('detect dual from JSON exports', () => {
-    expect(
-      detectModuleFormat({
-        main: 'test.json',
-        exports: {
-          '.': './test.json',
-        },
-      }),
-    ).toBe('dual')
-  })
-
-  it('detect esm from JSON exports', () => {
-    expect(
-      detectModuleFormat({
-        exports: {
-          '.': './test.json',
-        },
-      }),
-    ).toBe('esm')
-  })
-
-  it('detects ESM when a type: module package uses default conditions', () => {
-    expect(
-      detectModuleFormat({
-        type: 'module',
-        exports: {
-          '.': {
-            types: './dist/index.d.ts',
-            default: './dist/index.js',
-          },
-        },
-      }),
-    ).toBe('esm')
-  })
-
-  it('preserves type: module through export fallback arrays', () => {
-    // The .js sits behind a fallback array, so this only resolves to ESM if the
-    // package type survives the recursion into the array
-    expect(
-      detectModuleFormat({
-        type: 'module',
-        exports: {
-          '.': ['./dist/index.js'],
-          './init': './dist/init.cjs',
-        },
-      }),
-    ).toBe('dual')
-  })
-
-  it('detects dual when a type: module package also exports a .cjs subpath', () => {
-    // A .js entry in a type: module package is ESM, so a CJS subpath elsewhere
-    // makes the package dual rather than reclassifying the whole thing as CJS
-    expect(
-      detectModuleFormat({
-        type: 'module',
-        exports: {
-          '.': {
-            types: './dist/index.d.ts',
-            default: './dist/index.js',
-          },
-          './init': {
-            types: './dist/init.d.cts',
-            default: './dist/init.cjs',
-          },
-        },
-      }),
-    ).toBe('dual')
-  })
-
-  it('detects CJS when a commonjs package uses default conditions', () => {
-    expect(
-      detectModuleFormat({
-        type: 'commonjs',
-        exports: {
-          '.': {
-            types: './dist/index.d.ts',
-            default: './dist/index.js',
-          },
-        },
-      }),
-    ).toBe('cjs')
-  })
-
-  it('ignores a re-exported package.json when inferring format', () => {
-    // "./package.json": "./package.json" is boilerplate, not an ESM entry point
-    expect(
-      detectModuleFormat({
-        type: 'commonjs',
-        exports: {
-          '.': {
-            types: './dist/index.d.ts',
-            default: './dist/index.js',
-          },
-          './package.json': './package.json',
-        },
-      }),
-    ).toBe('cjs')
-  })
-
-  it('detects WASM from main field', () => {
-    expect(detectModuleFormat({ main: 'main.wasm' })).toBe('wasm')
-  })
-})
-
 describe('detectTypesStatus', () => {
   it('detects included types from types field', () => {
     expect(detectTypesStatus({ types: './index.d.ts' })).toEqual({ kind: 'included' })

From 231b73c2f508b3966d517728f791eab12ecff613 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:10:34 +0000
Subject: [PATCH 15/28] [autofix.ci] apply automated fixes

---
 test/unit/shared/utils/package-analysis.spec.ts | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/test/unit/shared/utils/package-analysis.spec.ts b/test/unit/shared/utils/package-analysis.spec.ts
index 0916dd13b3..c7a7315d4d 100644
--- a/test/unit/shared/utils/package-analysis.spec.ts
+++ b/test/unit/shared/utils/package-analysis.spec.ts
@@ -1,8 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import {
-  analyzePackage,
-  detectTypesStatus,
-} from '#shared/utils/package-analysis'
+import { analyzePackage, detectTypesStatus } from '#shared/utils/package-analysis'
 
 describe('detectTypesStatus', () => {
   it('detects included types from types field', () => {

From 2bef559ed3f0ea6255120e4a741d47b000aadefa Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 15:58:01 +0000
Subject: [PATCH 16/28] feat: use `hasBuiltInTypes` from `npmeta`

---
 shared/utils/package-analysis.ts | 121 +------------------------------
 1 file changed, 2 insertions(+), 119 deletions(-)

diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index 15a85b3b75..a027fbc70e 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -1,4 +1,4 @@
-import { detectModuleFormat } from 'npmeta'
+import { detectModuleFormat, hasBuiltInTypes } from 'npmeta'
 
 /**
  * Package analysis utilities for detecting module format and TypeScript support
@@ -45,102 +45,6 @@ export interface ExtendedPackageJson {
 
 type PackageExports = string | null | { [key: string]: PackageExports } | PackageExports[]
 
-interface ExportsAnalysis {
-  hasImport: boolean
-  hasRequire: boolean
-  hasModule: boolean
-  hasTypes: boolean
-}
-
-/**
- * Recursively analyze exports field for module format indicators
- */
-function analyzeExports(
-  exports: PackageExports,
-  isTypeModule: boolean,
-  depth = 0,
-): ExportsAnalysis {
-  const result: ExportsAnalysis = {
-    hasImport: false,
-    hasRequire: false,
-    hasModule: false,
-    hasTypes: false,
-  }
-
-  // Prevent infinite recursion
-  if (depth > 10) return result
-
-  if (exports === null || exports === undefined) {
-    return result
-  }
-
-  if (typeof exports === 'string') {
-    // Re-exposing the manifest (`"./package.json": "./package.json"`) is
-    // boilerplate that packages ship regardless of format. Counting it as an
-    // ESM signal makes plain CJS packages look like they expose an ESM entry.
-    if (exports === './package.json') {
-      return result
-    }
-
-    // Check file extension for format hints
-    if (exports.endsWith('.mjs') || exports.endsWith('.mts') || exports.endsWith('.json')) {
-      result.hasImport = true
-    } else if (exports.endsWith('.cjs') || exports.endsWith('.cts')) {
-      result.hasRequire = true
-    } else if (exports.endsWith('.js')) {
-      // A bare .js file has no format of its own. Node resolves it against the
-      // package's "type" field. Without this, an ESM package that points its
-      // conditions at .js files gives off no ESM signal at all, and a single
-      // .cjs subpath elsewhere in the tree is enough to classify it as CJS.
-      if (isTypeModule) {
-        result.hasImport = true
-      } else {
-        result.hasRequire = true
-      }
-    }
-    if (exports.endsWith('.d.ts') || exports.endsWith('.d.mts') || exports.endsWith('.d.cts')) {
-      result.hasTypes = true
-    }
-    return result
-  }
-
-  if (Array.isArray(exports)) {
-    for (const item of exports) {
-      const subResult = analyzeExports(item, isTypeModule, depth + 1)
-      mergeExportsAnalysis(result, subResult)
-    }
-    return result
-  }
-
-  if (typeof exports === 'object') {
-    for (const [key, value] of Object.entries(exports)) {
-      // Check condition keys
-      if (key === 'import') {
-        result.hasImport = true
-      } else if (key === 'require') {
-        result.hasRequire = true
-      } else if (key === 'module') {
-        result.hasModule = true
-      } else if (key === 'types') {
-        result.hasTypes = true
-      }
-
-      // Recurse into nested exports
-      const subResult = analyzeExports(value, isTypeModule, depth + 1)
-      mergeExportsAnalysis(result, subResult)
-    }
-  }
-
-  return result
-}
-
-function mergeExportsAnalysis(target: ExportsAnalysis, source: ExportsAnalysis): void {
-  target.hasImport = target.hasImport || source.hasImport
-  target.hasRequire = target.hasRequire || source.hasRequire
-  target.hasModule = target.hasModule || source.hasModule
-  target.hasTypes = target.hasTypes || source.hasTypes
-}
-
 /** Info about a related package (@types or create-*) */
 interface RelatedPackageInfo {
   packageName: string
@@ -252,7 +156,7 @@ export function detectTypesStatus(
 
   // Check for implicit types by deriving expected declaration file paths from
   // entry points (e.g. .d.mts for .mjs) and checking if they exist in the package
-  if (files && hasImplicitTypesForEntryPoints(pkg, files)) {
+  if (files && f(pkg, files)) {
     return { kind: 'included' }
   }
 
@@ -268,27 +172,6 @@ export function detectTypesStatus(
   return { kind: 'none' }
 }
 
-/**
- * Check if a package has built-in TypeScript types
- * (without needing to check for @types packages)
- */
-export function hasBuiltInTypes(pkg: ExtendedPackageJson): boolean {
-  // Check types/typings field
-  if (pkg.types || pkg.typings) {
-    return true
-  }
-
-  // Check exports field for types
-  if (pkg.exports) {
-    const exportInfo = analyzeExports(pkg.exports, pkg.type === 'module')
-    if (exportInfo.hasTypes) {
-      return true
-    }
-  }
-
-  return false
-}
-
 /**
  * Options for package analysis
  */

From 97b171eda26363365c6f21d68480ab9bf53a2ac2 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 15:58:45 +0000
Subject: [PATCH 17/28] fix

---
 shared/utils/package-analysis.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index a027fbc70e..5b16b7d046 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -156,7 +156,7 @@ export function detectTypesStatus(
 
   // Check for implicit types by deriving expected declaration file paths from
   // entry points (e.g. .d.mts for .mjs) and checking if they exist in the package
-  if (files && f(pkg, files)) {
+  if (files && hasImplicitTypesForEntryPoints(pkg, files)) {
     return { kind: 'included' }
   }
 

From c861b77142ce28f3bc41fa51c13ea15408d38a53 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 20:10:38 +0000
Subject: [PATCH 18/28] fix: resolve merge conflict

---
 app/components/Compare/PackageSelector.vue | 2 ++
 app/composables/useCompareReplacements.ts  | 2 +-
 app/pages/compare.vue                      | 1 +
 shared/utils/compare.ts                    | 2 +-
 4 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/components/Compare/PackageSelector.vue b/app/components/Compare/PackageSelector.vue
index 2cad026112..b1b5d84e37 100644
--- a/app/components/Compare/PackageSelector.vue
+++ b/app/components/Compare/PackageSelector.vue
@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { parsePackageSpec } from 'npmeta'
+
 const packages = defineModel<string[]>({ required: true })
 
 const props = defineProps<{
diff --git a/app/composables/useCompareReplacements.ts b/app/composables/useCompareReplacements.ts
index c578e06c5a..2b1779969f 100644
--- a/app/composables/useCompareReplacements.ts
+++ b/app/composables/useCompareReplacements.ts
@@ -1,6 +1,6 @@
 import type { ModuleReplacement, ModuleReplacementMapping } from 'module-replacements'
+import { parsePackageSpec } from 'npmeta'
 import { NO_DEPENDENCY_ID } from '#shared/utils/compare'
-import { parsePackageSpec } from '#shared/utils/parse-package-param'
 
 export interface ReplacementSuggestion {
   forPackage: string
diff --git a/app/pages/compare.vue b/app/pages/compare.vue
index 6b7394adf0..8ed08f1e0a 100644
--- a/app/pages/compare.vue
+++ b/app/pages/compare.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { useRouteQuery } from '@vueuse/router'
+import { parsePackageSpec } from 'npmeta'
 import FacetBarChart from '~/components/Compare/FacetBarChart.vue'
 import type { CommandPaletteContextCommandInput } from '~/types/command-palette'
 import FacetScatterChart from '~/components/Compare/FacetScatterChart.vue'
diff --git a/shared/utils/compare.ts b/shared/utils/compare.ts
index e2e77625e0..7be1b4f87b 100644
--- a/shared/utils/compare.ts
+++ b/shared/utils/compare.ts
@@ -1,5 +1,5 @@
+import { parsePackageSpec } from 'npmeta'
 import type { ComparisonPackage } from '../types/comparison'
-import { parsePackageSpec } from './parse-package-param'
 
 /** Special identifier for the "What Would James Do?" comparison column */
 export const NO_DEPENDENCY_ID = '__no_dependency__'

From 21e3d486329927a9275e5f3a2e335806e6a60732 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 20:40:53 +0000
Subject: [PATCH 19/28] chore: use `parsePackageSpec`

---
 modules/runtime/server/cache.ts | 38 ++++++---------------------------
 1 file changed, 6 insertions(+), 32 deletions(-)

diff --git a/modules/runtime/server/cache.ts b/modules/runtime/server/cache.ts
index d1c331bc3b..ea7f3e994a 100644
--- a/modules/runtime/server/cache.ts
+++ b/modules/runtime/server/cache.ts
@@ -212,22 +212,9 @@ async function processSingleFastNpmMeta(
   storage: ReturnType<typeof useStorage>,
   metadata: boolean,
 ): Promise<Record<string, unknown>> {
-  let packageName = packageQuery
-  let specifier = 'latest'
-
-  if (packageName.startsWith('@')) {
-    const atIndex = packageName.indexOf('@', 1)
-    if (atIndex !== -1) {
-      specifier = packageName.slice(atIndex + 1)
-      packageName = packageName.slice(0, atIndex)
-    }
-  } else {
-    const atIndex = packageName.indexOf('@')
-    if (atIndex !== -1) {
-      specifier = packageName.slice(atIndex + 1)
-      packageName = packageName.slice(0, atIndex)
-    }
-  }
+  const parsed = parsePackageSpec(packageQuery)
+  const packageName = parsed.name
+  const specifier = parsed.version || 'latest'
 
   // Special case: packages with "does-not-exist" in the name should 404
   if (packageName.includes('does-not-exist') || packageName.includes('nonexistent')) {
@@ -286,22 +273,9 @@ async function processSingleVersionsMeta(
   storage: ReturnType<typeof useStorage>,
   metadata: boolean,
 ): Promise<Record<string, unknown>> {
-  let packageName = packageQuery
-  let specifier = '*'
-
-  if (packageName.startsWith('@')) {
-    const atIndex = packageName.indexOf('@', 1)
-    if (atIndex !== -1) {
-      specifier = packageName.slice(atIndex + 1)
-      packageName = packageName.slice(0, atIndex)
-    }
-  } else {
-    const atIndex = packageName.indexOf('@')
-    if (atIndex !== -1) {
-      specifier = packageName.slice(atIndex + 1)
-      packageName = packageName.slice(0, atIndex)
-    }
-  }
+  const parsed = parsePackageSpec(packageQuery)
+  const packageName = parsed.name
+  const specifier = parsed.version || '*'
 
   if (packageName.includes('does-not-exist') || packageName.includes('nonexistent')) {
     return { name: packageName, error: 'not_found' }

From d7af9a884ad2786c0149cd676fd2e0c64115262e Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 22:51:41 +0000
Subject: [PATCH 20/28] chore: reuse `splitPackageName`

---
 app/utils/platform-packages.ts |  4 +++-
 app/utils/run-command.ts       | 12 +++---------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/app/utils/platform-packages.ts b/app/utils/platform-packages.ts
index 45a126898c..f0aff040d3 100644
--- a/app/utils/platform-packages.ts
+++ b/app/utils/platform-packages.ts
@@ -1,3 +1,5 @@
+import { splitPackageName } from 'npmeta'
+
 /**
  * Detects if a package name is a platform-specific native binary package.
  * These are typically optional dependencies that contain native binaries
@@ -44,7 +46,7 @@ const ABI_SUFFIXES = new Set(['gnu', 'musl', 'msvc', 'gnueabihf'])
  * @returns true if the package appears to be a platform-specific binary
  */
 export function isPlatformSpecificPackage(name: string): boolean {
-  const unscopedName = name.startsWith('@') ? (name.split('/')[1] ?? '') : name
+  const unscopedName = splitPackageName(name).name
   if (!unscopedName) return false
 
   const parts = unscopedName.split('-')
diff --git a/app/utils/run-command.ts b/app/utils/run-command.ts
index 265acbf7af..1fc5526fbc 100644
--- a/app/utils/run-command.ts
+++ b/app/utils/run-command.ts
@@ -1,4 +1,5 @@
 import type { JsrPackageInfo } from '#shared/types/jsr'
+import { splitPackageName } from 'npmeta'
 import { getPackageSpecifier, packageManagers } from './install-command'
 import type { PackageManagerId } from './install-command'
 
@@ -14,13 +15,6 @@ export interface ExecutableInfo {
   hasExecutable: boolean
 }
 
-/**
- * Extract basename from package
- */
-function getPackageBaseName(packageName: string): string | undefined {
-  return packageName.startsWith('@') ? packageName.split('/')[1] : packageName
-}
-
 /**
  * Extract executable command information from a package's bin field.
  * Handles both string format ("bin": "./cli.js") and object format ("bin": { "cmd": "./cli.js" }).
@@ -50,7 +44,7 @@ export function getExecutableInfo(
   }
 
   // Prefer command matching package name if it exists; otherwise, use first
-  const baseName = getPackageBaseName(packageName)
+  const baseName = splitPackageName(packageName).name
   const primaryCommand = baseName && commands.includes(baseName) ? baseName : firstCommand
 
   return {
@@ -94,7 +88,7 @@ export function getRunCommandParts(options: RunCommandOptions): string[] {
   // For local execute with specific command name different from package name
   // e.g., `pnpm exec tsc` for typescript package
   if (options.command && options.command !== options.packageName) {
-    const baseName = getPackageBaseName(options.packageName)
+    const baseName = splitPackageName(options.packageName).name
     // If command matches base package name, use the package spec
     if (options.command === baseName) {
       return [...executeParts, spec]

From 3778ee46eb7aced98026afeed318046cae7d8e01 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 22:53:09 +0000
Subject: [PATCH 21/28] update `npmeta` to v0.2.0

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index cdb9e36036..b40ec3a4d8 100644
--- a/package.json
+++ b/package.json
@@ -92,7 +92,7 @@
     "ipaddr.js": "2.5.0",
     "marked": "18.0.9",
     "module-replacements": "3.3.0",
-    "npmeta": "0.1.0",
+    "npmeta": "0.2.0",
     "nuxt": "4.5.2",
     "nuxt-og-image": "6.7.8",
     "ofetch": "1.5.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 25a3e0703c..cbabee4fbf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -217,8 +217,8 @@ importers:
         specifier: 3.3.0
         version: 3.3.0
       npmeta:
-        specifier: 0.1.0
-        version: 0.1.0
+        specifier: 0.2.0
+        version: 0.2.0
       nuxt:
         specifier: 4.5.2
         version: 4.5.2(@babel/plugin-syntax-jsx@7.29.7)(@babel/plugin-syntax-typescript@7.29.7)(@oxc-project/types@0.154.0)(@parcel/watcher@2.5.6)(@rollup/plugin-babel@6.1.0)(@types/node@24.13.3)(@upstash/redis@1.38.2)(@vitejs/devtools-kit@0.4.10)(@voidzero-dev/vite-plus-core@1.3.0)(@volar/typescript@2.4.28)(@vue/compiler-sfc@3.5.42)(@vue/language-core@3.3.13)(better-sqlite3@13.0.3)(cac@7.0.0)(confbox@0.2.4)(db0@0.3.4)(dotenv@17.4.2)(encoding@0.1.13)(esbuild@0.28.1)(eslint@10.6.0)(giget@3.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.144.0)(oxlint@1.88.0)(rolldown@1.2.4)(rollup-plugin-visualizer@7.0.1)(rollup@4.62.2)(srvx@0.11.22)(supports-color@10.2.2)(terser@5.48.0)(typescript-native-bridge@6.0.3-bridge.13.tsgo.7.0.2)(vue-tsc@3.3.10)(webpack@5.108.4)(yaml@2.9.1)
@@ -8533,8 +8533,8 @@ packages:
     resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
     engines: {node: '>=18'}
 
-  npmeta@0.1.0:
-    resolution: {integrity: sha512-hHcFtHvbXV7kuffxUDZAVaMhQd5HKmDbBFx6HKK5pUju1Miv90uYSDTSO3bl5at3IlNa1ZiMriKfnaGk7lZAAA==}
+  npmeta@0.2.0:
+    resolution: {integrity: sha512-iOL9zd1hSr12U/fZqkq5TwdMPfl1R8cZ3excBvoaK43phH1rdtdcqTjgN1J3eRxujC2bxqYHFsVoFGRm9PWWWw==}
     engines: {node: '>=22'}
 
   nth-check@2.1.1:
@@ -20611,7 +20611,7 @@ snapshots:
       path-key: 4.0.0
       unicorn-magic: 0.3.0
 
-  npmeta@0.1.0: {}
+  npmeta@0.2.0: {}
 
   nth-check@2.1.1:
     dependencies:

From 7047b8e832fa5c274d91f2a689af0d04141a4da9 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 22:56:13 +0000
Subject: [PATCH 22/28] fix

---
 app/utils/install-command.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/utils/install-command.ts b/app/utils/install-command.ts
index ada658a785..d1e6c9e5dd 100644
--- a/app/utils/install-command.ts
+++ b/app/utils/install-command.ts
@@ -182,7 +182,7 @@ function getCreatePackageSpecifier(options: ExecuteCommandOptions): string | nul
   }
 
   const shortName = getCreateShortName(options.packageName)
-  if (shortName === options.packageName) {
+  if (shortName === null) {
     return null
   }
 

From 3a99daa8ec9ee7cfc0647b1de1099803e6aa77f2 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 23:06:31 +0000
Subject: [PATCH 23/28] feat: reuse `splitPackageName`

---
 app/components/Package/AccessControls.vue | 9 +++------
 app/components/Package/Maintainers.vue    | 7 ++-----
 app/utils/package-name.ts                 | 4 ++--
 3 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/app/components/Package/AccessControls.vue b/app/components/Package/AccessControls.vue
index 05b2360b29..dad1417aa2 100644
--- a/app/components/Package/AccessControls.vue
+++ b/app/components/Package/AccessControls.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { splitPackageName } from 'npmeta'
 import type { NewOperation } from '~/composables/useConnector'
 import { buildScopeTeam } from '~/utils/npm/common'
 
@@ -15,12 +16,8 @@ const {
   error: connectorError,
 } = useConnector()
 
-// Extract org name from scoped package (e.g., "@nuxt/kit" -> "nuxt")
-const orgName = computed(() => {
-  if (!props.packageName.startsWith('@')) return null
-  const match = props.packageName.match(/^@([^/]+)\//)
-  return match ? match[1] : null
-})
+// Extract org name from scoped package
+const orgName = computed(() => splitPackageName(props.packageName).scope)
 
 // Data
 const collaborators = shallowRef<Record<string, 'read-only' | 'read-write'>>({})
diff --git a/app/components/Package/Maintainers.vue b/app/components/Package/Maintainers.vue
index a5b333a8fa..d9784e151a 100644
--- a/app/components/Package/Maintainers.vue
+++ b/app/components/Package/Maintainers.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { splitPackageName } from 'npmeta'
 import type { NewOperation } from '~/composables/useConnector'
 
 const props = defineProps<{
@@ -38,11 +39,7 @@ const hiddenMaintainersCount = computed(() =>
 )
 
 // Extract org name from scoped package
-const orgName = computed(() => {
-  if (!props.packageName.startsWith('@')) return null
-  const match = props.packageName.match(/^@([^/]+)\//)
-  return match ? match[1] : null
-})
+const orgName = computed(() => splitPackageName(props.packageName).scope)
 
 // Access data: who has access and via what
 const collaborators = shallowRef<Record<string, 'read-only' | 'read-write'>>({})
diff --git a/app/utils/package-name.ts b/app/utils/package-name.ts
index f68089a606..69208666b0 100644
--- a/app/utils/package-name.ts
+++ b/app/utils/package-name.ts
@@ -1,4 +1,4 @@
-import { encodePackageName } from 'npmeta'
+import { encodePackageName, splitPackageName } from 'npmeta'
 import validatePackageName from 'validate-npm-package-name'
 import { NPM_REGISTRY } from '#shared/utils/constants'
 
@@ -8,7 +8,7 @@ import { NPM_REGISTRY } from '#shared/utils/constants'
  */
 export function normalizePackageName(name: string): string {
   // Remove scope if present
-  const unscoped = name.startsWith('@') ? name.split('/')[1] || name : name
+  const unscoped = splitPackageName(name).name
 
   // Normalize: lowercase, remove punctuation (.-_), remove 'js' and 'node' suffixes/prefixes
   return (

From f18bc2a704b65921bb93073d7792f0300ea0b5a6 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 23:11:56 +0000
Subject: [PATCH 24/28] fix

---
 pnpm-workspace.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7df3db102b..7eeb87b3e0 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -51,7 +51,7 @@ minimumReleaseAgeExclude:
   - '@nuxt/schema@4.5.2'
   - '@nuxt/vite-builder@4.5.2'
   - vue-data-ui@3.28.7
-  - 'npmeta@0.1.0'
+  - 'npmeta@0.2.0'
 
 minimumReleaseAgeExcludePrune: true
 

From 3bd87d3bb69d39a227eec255c0ebc637a7cf7337 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Fri, 30 Oct 2026 23:40:29 +0000
Subject: [PATCH 25/28] feat: use `parsePackageSpec`

---
 app/components/Compare/FacetCard.vue   | 13 +++----------
 app/components/DependencyPathPopup.vue | 14 +++-----------
 2 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/app/components/Compare/FacetCard.vue b/app/components/Compare/FacetCard.vue
index 1b69834bb0..447c9d3757 100644
--- a/app/components/Compare/FacetCard.vue
+++ b/app/components/Compare/FacetCard.vue
@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { parsePackageSpec } from 'npmeta'
+
 const props = defineProps<{
   /** Facet label */
   label: string
@@ -57,15 +59,6 @@ function getStatusClass(status?: FacetValue['status']): string {
 function isCellLoading(index: number): boolean {
   return props.facetLoading || (props.columnLoading?.[index] ?? false)
 }
-
-// Get short package name (without version) for mobile display
-function getShortName(header: string): string {
-  const atIndex = header.lastIndexOf('@')
-  if (atIndex > 0) {
-    return header.substring(0, atIndex)
-  }
-  return header
-}
 </script>
 
 <template>
@@ -102,7 +95,7 @@ function getShortName(header: string): string {
           class="relative font-mono text-xs text-fg-muted truncate flex-shrink-0"
           :title="headers[index]"
         >
-          {{ getShortName(headers[index] ?? '') }}
+          {{ parsePackageSpec(headers[index] ?? '').name }}
         </span>
 
         <!-- Value -->
diff --git a/app/components/DependencyPathPopup.vue b/app/components/DependencyPathPopup.vue
index 9d0f40ba4d..e501dd77f4 100644
--- a/app/components/DependencyPathPopup.vue
+++ b/app/components/DependencyPathPopup.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { onKeyDown } from '@vueuse/core'
 import { UseFocusTrap } from '@vueuse/integrations/useFocusTrap/component'
+import { parsePackageSpec } from 'npmeta'
 
 defineProps<{
   /** Dependency path from root to vulnerable package (readonly from VulnerabilityTreeResult) */
@@ -52,15 +53,6 @@ function getPopupStyle(): Record<string, string> {
     left: `${popupPosition.value.left}px`,
   }
 }
-
-// Parse package string "name@version" into { name, version }
-function parsePackageString(pkg: string): { name: string; version: string } {
-  const atIndex = pkg.lastIndexOf('@')
-  if (atIndex > 0) {
-    return { name: pkg.slice(0, atIndex), version: pkg.slice(atIndex + 1) }
-  }
-  return { name: pkg, version: '' }
-}
 </script>
 
 <template>
@@ -95,8 +87,8 @@ function parsePackageString(pkg: string): { name: string; version: string } {
             <NuxtLink
               :to="
                 packageRoute(
-                  parsePackageString(pathItem).name,
-                  parsePackageString(pathItem).version,
+                  parsePackageSpec(pathItem).name,
+                  parsePackageSpec(pathItem).version,
                 )
               "
               class="hover:underline"

From 98d484ca612557fbd605282464570da7c215a63b Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 23:41:38 +0000
Subject: [PATCH 26/28] [autofix.ci] apply automated fixes

---
 app/components/DependencyPathPopup.vue | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/app/components/DependencyPathPopup.vue b/app/components/DependencyPathPopup.vue
index e501dd77f4..310ccc6ef0 100644
--- a/app/components/DependencyPathPopup.vue
+++ b/app/components/DependencyPathPopup.vue
@@ -86,10 +86,7 @@ function getPopupStyle(): Record<string, string> {
             <span v-if="idx > 0" class="text-fg-subtle me-1">└─</span>
             <NuxtLink
               :to="
-                packageRoute(
-                  parsePackageSpec(pathItem).name,
-                  parsePackageSpec(pathItem).version,
-                )
+                packageRoute(parsePackageSpec(pathItem).name, parsePackageSpec(pathItem).version)
               "
               class="hover:underline"
               :class="idx === path.length - 1 ? 'text-fg font-medium' : 'text-fg-muted'"

From 54016ef61b82eca149163ca922aca1d9ea4ab9b3 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Sat, 31 Oct 2026 00:01:53 +0000
Subject: [PATCH 27/28] import `ModuleFormat` analysis from `npmeta`

---
 app/composables/usePackageAnalysis.ts | 3 ++-
 shared/utils/package-analysis.ts      | 8 +-------
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/app/composables/usePackageAnalysis.ts b/app/composables/usePackageAnalysis.ts
index 2e083a1b89..acccd93664 100644
--- a/app/composables/usePackageAnalysis.ts
+++ b/app/composables/usePackageAnalysis.ts
@@ -1,4 +1,5 @@
-import type { ModuleFormat, TypesStatus, CreatePackageInfo } from '#shared/utils/package-analysis'
+import type { ModuleFormat } from 'npmeta'
+import type { TypesStatus, CreatePackageInfo } from '#shared/utils/package-analysis'
 import type { DevDependencySuggestion } from '#shared/utils/dev-dependency'
 
 export interface PackageAnalysisResponse {
diff --git a/shared/utils/package-analysis.ts b/shared/utils/package-analysis.ts
index 5b16b7d046..c89c5ba1d1 100644
--- a/shared/utils/package-analysis.ts
+++ b/shared/utils/package-analysis.ts
@@ -1,12 +1,6 @@
+import type { ModuleFormat } from 'npmeta'
 import { detectModuleFormat, hasBuiltInTypes } from 'npmeta'
 
-/**
- * Package analysis utilities for detecting module format and TypeScript support
- */
-
-// TODO(Roman): replace once exported from `npmeta`
-export type ModuleFormat = ReturnType<typeof detectModuleFormat>
-
 export type TypesStatus =
   | { kind: 'included' }
   | { kind: '@types'; packageName: string; deprecated?: string }

From ee77296e90ddec7a5139c7214f40b01cecd79882 Mon Sep 17 00:00:00 2001
From: Roman <dev@rman.dev>
Date: Sat, 31 Oct 2026 11:40:26 +0000
Subject: [PATCH 28/28] feat: use `splitPackageName` in
 `isKnownDevDependencyPackage`

---
 shared/utils/dev-dependency.ts | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/shared/utils/dev-dependency.ts b/shared/utils/dev-dependency.ts
index 1572d9af48..1ba1d6ae63 100644
--- a/shared/utils/dev-dependency.ts
+++ b/shared/utils/dev-dependency.ts
@@ -1,3 +1,5 @@
+import { splitPackageName } from 'npmeta'
+
 type DevDependencySuggestionReason = 'known-package' | 'readme-hint'
 
 export interface DevDependencySuggestion {
@@ -33,6 +35,7 @@ const KNOWN_DEV_DEPENDENCY_PACKAGES = new Set<string>([
 ])
 
 const KNOWN_DEV_DEPENDENCY_PACKAGE_PREFIXES = [
+  '@types/',
   '@typescript-eslint/',
   'eslint-',
   'prettier-',
@@ -43,18 +46,14 @@ const KNOWN_DEV_DEPENDENCY_PACKAGE_PREFIXES = [
 
 function isKnownDevDependencyPackage(packageName: string): boolean {
   const normalized = packageName.toLowerCase()
-  if (normalized.startsWith('@types/')) {
-    return true
-  }
-  // Match scoped packages by name segment, e.g. @scope/eslint-config
-  const namePart = normalized.includes('/') ? normalized.split('/').pop() : normalized
-  if (!namePart) return false
+  const { name } = splitPackageName(normalized)
+  if (!name) return false
 
   return (
     KNOWN_DEV_DEPENDENCY_PACKAGES.has(normalized) ||
-    KNOWN_DEV_DEPENDENCY_PACKAGES.has(namePart) ||
+    KNOWN_DEV_DEPENDENCY_PACKAGES.has(name) ||
     KNOWN_DEV_DEPENDENCY_PACKAGE_PREFIXES.some(prefix =>
-      prefix.startsWith('@') ? normalized.startsWith(prefix) : namePart.startsWith(prefix),
+      prefix.startsWith('@') ? normalized.startsWith(prefix) : name.startsWith(prefix),
     )
   )
 }